ci: fix integration Docker build cache (write back to registry)

[zeevdr]

Summary

• The integration job was reading Docker layer cache from ghcr.io but writing it to a local runner path that is discarded when the job ends — so the cache was effectively never warm and every run rebuilt both images from scratch.
• Switching `cache-to` to `type=registry` (same refs as `cache-from`) closes the write-back loop: the first run seeds the cache, subsequent runs hit it.
• `packages: write` added to the job permissions so the `GITHUB_TOKEN` can push the cache manifest to ghcr.io.

Test plan

• Verify the integration job succeeds on this PR (first run seeds the cache)
• Trigger a second run (re-push or re-run) and confirm "Build tools image" and "Build server image" steps show cache HIT logs from Buildx, reducing build time significantly

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!