fix(grid-rs): build the actual binary, not the stub

Previous Dockerfile compiled a 'fn main(){}' placeholder to warm the
dep cache, then was supposed to rebuild with real source — but cargo's
fingerprint wasn't picking up the re-added source after rm -rf, so the
placeholder artefact (~430 KB) was what got COPY'd into runtime.

Replace the stub-then-real dance with a single cache-mounted build.
BuildKit persists /usr/local/cargo/registry + git + /src/target across
runs, so dep changes are the only full-rebuild trigger. Copy the real
binary into /usr/local/bin/worker before the COPY --from= in runtime
because COPY --from= can't read from a cache mount.

rust/prop_grid_rs/Dockerfile

@@ -16,21 +16,24 @@ WORKDIR /src
 # Cache deps: copy manifests first so dependency changes alone don't
 # invalidate the source-layer cache.
 COPY Cargo.toml Cargo.lock* ./
-RUN mkdir -p src src/bin \
- && echo 'fn main() {}' > src/bin/worker.rs \
- && echo '' > src/lib.rs \
- && cargo build --release --bin worker \
- && rm -rf src
-
 COPY src ./src
 COPY tests ./tests
 
-# Lint + test gate the image build — a regressed scorer or a clippy
+# BuildKit cache mounts persist cargo's registry + git + target
-# warning never produces a pushable image.
+# directories across CI runs, so dependency changes are the only
-RUN rustup component add clippy \
+# thing that triggers a full rebuild. Lint + test gate the image
+# build — a regressed scorer or a clippy warning never produces a
+# pushable image. `target/` is cached but the final binary is
+# copied out into a non-cached path so the runtime stage can reach
+# it (COPY --from= can't read from a cache mount).
+RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
+    --mount=type=cache,target=/usr/local/cargo/git,sharing=locked \
+    --mount=type=cache,target=/src/target,sharing=locked \
+    rustup component add clippy \
  && cargo clippy --all-targets -- -D warnings \
  && cargo test --release \
- && cargo build --release --bin worker
+ && cargo build --release --bin worker \
+ && cp target/release/worker /usr/local/bin/worker
 
 # Runtime image: slim debian + the shared libs wgrib2 links against.
 # libgfortran5/libaec0/zlib1g/libpng16-16t64/libopenjp2-7 mirror the
@@ -50,7 +53,7 @@ COPY --from=wgrib2-src /usr/local/bin/wgrib2 /usr/local/bin/wgrib2
 COPY --from=wgrib2-src /usr/local/lib/libg2c.so* /usr/local/lib/
 RUN ldconfig
 
-COPY --from=builder /src/target/release/worker /usr/local/bin/prop-grid-rs
+COPY --from=builder /usr/local/bin/worker /usr/local/bin/prop-grid-rs
 
 USER 65534:65534
 ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/prop-grid-rs"]