[AlxcBTW]

Two things in one PR (the cache hygiene of step 2 and the prebuilt images of step 6).

Cache hygiene

save-if: ${{ github.ref == 'refs/heads/main' }} on every Swatinem/rust-cache step (ci, fuzz, network-drift); keys unchanged. The repo held 11.95 GB of the 10 GB limit. Done once, outside the diff: deleted the two stale PR-ref entries of merged PRs 62 and 66 (ids 9474471456, 9472826709; listed first, deleted exactly those). Note for the operator: main still holds older duplicates (the ...-bd87e271 keys: postgres 0.9, Windows 1.8, Linux 1.4 GB, superseded by ...-037dd366); I left them, they are main-ref entries and will age out.

Prebuilt images (ADR 0007, docs/deploy.md)

• deploy/Dockerfile: cargo-chef (0.1.78, pinned): planner -> cook (dependency layer) -> build. A source change compiles only the sources. The base image pin is unchanged.
• New workflow image.yml: on every merge to main builds the cloud and relay targets with BuildKit (type=gha, scope per image), pushes ghcr.io/anyplaynet/cloud:<sha> + :main and .../relay:<sha> + :main with SBOM and provenance, and attests each digest with actions/attest-build-provenance. The job summary prints the exact update.sh command. On PRs touching the Dockerfile the same build runs without pushing (this PR's image check).
• ci.yml docker and kubernetes.yml kind now build with the same action and read main's BuildKit cache (read only), so PR image builds start from the cached dependency layer once main has written it. Job and check names unchanged.
• deploy/compose.yaml: explicit image: anyplay-cloud|relay|caddy (the names compose derived before, so nothing changes for a build).
• deploy/update.sh --cloud <commit> --image sha256:... --relay-image sha256:... [--no-attestation]: pulls both images by digest instead of building them; refuses (running version untouched) when the pull fails, when an image's org.opencontainers.image.revision label is not the cloud commit, or when gh attestation verify rejects it (if gh is there). Caddy/web still build locally. Backup, rollback tags, health check and rollback are unchanged; the old build path is the fallback when --image is absent. Pulled images are tagged anyplay-cloud/anyplay-relay only right before up, so a failed pull, check or backup leaves the old tags alone.

Time, old -> expected

• Deploy: 20-27 min (operator's clock 26.10.) -> pull + backup + swap + health check, expected about 1-2 min (the plan's estimate: pull 100-300 MB about 10-20 s, swap and health 20-30 s; the backup stays). The server's own build time was never measured.
• Image build in CI: measured on this PR, cold cache and no push, image job 9:46 (cloud image about 5 min of it, the rest cache export and the relay target); docker job 5:03 for the cloud image cold. The warm number (dependency layer from cache) is not measured yet; first main run writes the cache. Expected 1.5-3 min once warm.
• Cache: PRs no longer evict main's Rust caches (Windows check cold 10:48-11:34 vs warm).

Not run

Nothing was run against the server. The push/attest steps of image.yml cannot run on a PR; the first run on main is their test (check the job summary and gh attestation verify oci://ghcr.io/anyplaynet/cloud@<digest> --repo anyplaynet/cloud). update.sh --image is only syntax-checked and run for its argument errors here (Docker is not allowed on this PC); shell CI passes (shellcheck).