ci(docker): AUT-921 use COPY --link to keep uv sync layer cacheable

[svcnemo-autobot]

Background

The CICD NeMo container build (cicd-container-build) re-runs the ~40 min uv sync layer on every build — including no-op main builds (observed: #16 DONE ~2400s on main→main with the registry cache present and the DeepEP layer #9 cached with identical digests).

Two compounding causes:

1. COPY cache miss: the dependency-manifest COPY steps that gate uv sync do not cache-hit against the mode=max registry cache even with identical content and a cached parent — a known BuildKit registry-cache/COPY interaction. COPY --link makes each an independent, content-addressed layer (parent- and metadata-independent), the standard remedy.
2. PR builds can't show it: the Compute cache keys step seeds every PR from main-buildcache and writes <PR>-buildcache, so a PR inherits only what main last built. Any Dockerfile-level cache fix therefore only takes effect after it lands on main and main rebuilds its cache — it is NOT observable on the PR build itself.

What changed

• Add --link to the six dependency-manifest COPY steps and the final source COPY in docker/Dockerfile.ci.

Details

Without --link, a COPY is keyed to the exact parent-layer chain and forces BuildKit to pull and extract the large DeepEP RUN layer just to run the copy; across CI's ephemeral per-run buildx builders these COPY layers reliably cache-miss, invalidating the expensive uv sync layer beneath them. Output semantics are unchanged (overlay-merge into /opt/Megatron-Bridge).

Tested

Both cicd-container-build jobs (aws+gcp) built successfully with --link on the prior head, proving the change is build-correct. The cache SPEEDUP is not observable on the PR build (seeds from main-buildcache); it must be validated on main's 2nd build after merge. No controlled two-build reproduction was run on this infra.

[svcnemo-autobot]

/ok to test bb47b41

[svcnemo-autobot]

CI note: the cicd-container-build jobs (aws + gcp) — the gate this COPY --link change targets — are green, so the fix builds correctly.

The red Launch_Unit_Tests_Core / Nemo_CICD_Test are a pre-existing failure on main, unrelated to this PR (which touches only docker/Dockerfile.ci):

tests/unit_tests/recipes/test_perf_recipe_environment.py::test_every_flat_recipe_builder_declares_its_environment_inline
tests/unit_tests/recipes/test_perf_recipe_environment.py::test_explicit_environment_invariants_across_all_flat_recipes
E   AssertionError: assert 397 == 396   (test_perf_recipe_environment.py:147 & :188)

The test hard-codes an expected perf-recipe-builder count of 396, but the repo now has 397 (a recipe builder was added without bumping the count). The same two tests fail identically on main's own CI (jobs 88494647557, 88466552646), so a CI re-run will not clear it and it is not caused by this change.

[svcnemo-autobot]

/ok to test bb47b41

[svcnemo-autobot]

/ok to test e8d764f