ci: AUT-945 seed a PR's container build from its own buildcache (#4995)

Signed-off-by: svcnemo-autobot <svcnemo-autobot@nvidia.com>

Author: svcnemo-autobot

.github/workflows/cicd-main.yml

@@ -411,10 +411,24 @@ jobs:
           # digest on every cold build. Listing more than one cache-from donor lets
           # BuildKit chain from a conflicting copy of such a layer and miss every
           # layer downstream — a ~40 min cold rebuild even when a warm cache exists.
-          # So read EXACTLY ONE donor: PR builds integrate into main, so they seed
-          # from main; main/branch builds seed from their own chain.
+          # So we still read EXACTLY ONE donor; only WHICH donor changes below.
+          #
+          # A PR's first build has no cache of its own and seeds from main. Every
+          # LATER push on the same PR seeds from the PR's OWN buildcache instead of
+          # main: a PR that touches an early layer (Dockerfile.ci, pyproject.toml,
+          # uv.lock, the MCore stubs) never has those layers in main-buildcache, so
+          # seeding from main cold-rebuilt the ~40 min dependency layer on EVERY
+          # push. Seeding from the PR's own cache reuses the layers that same PR
+          # already built and pushed to ${KEY}-buildcache. This stays single-donor,
+          # so the non-reproducible-DeepEP cascade above cannot happen. The probe
+          # falls back to main on any error, so this never fails the build.
           if [[ -n "$PR_NUMBER" && "${{ github.ref }}" != "refs/heads/main" ]]; then
-            SEED="main"
+            PR_CACHE="${{ matrix.registry }}/megatron-bridge:${KEY}-buildcache"
+            if docker buildx imagetools inspect "$PR_CACHE" > /dev/null 2>&1; then
+              SEED="$KEY"
+            else
+              SEED="main"
+            fi
           else
             SEED="$KEY"
           fi