perf(docker): cache CGO dep compile via go.sum-keyed prewarm layer

[benben]

Problem

Docker image builds redo two expensive things on every PR that the
non-Docker CI jobs already cache:

1. CGO dep compile — duckdb-go (libduckdb) + pg_query_go
   (libpg_query). actions/setup-go caches this for the test jobs
   (keyed on go.sum), but the cache doesn't reach Docker, and
   COPY . . busts the build layer on any source edit, so the
   multi-minute C/C++ compile re-runs each time.
2. Extension downloads — 5 curls (httpfs, ducklake, json,
   postgres_scanner, iceberg) that ran after COPY . . + build, so
   they re-fetched on every source edit despite depending only on the
   version args.

Measured CD build times (GHA, native arm64 runners):

image	time	matrix
worker	~367s	×4
main	~288s	×2
controlplane	~241s	×2

--mount=type=cache would not help on ephemeral GHA runners — the
GHA cache backend doesn't persist BuildKit cache mounts. Layer caching
(cache-to: type=gha,mode=max, already configured on all image
workflows) does, so the fix is to put every expensive step in a layer
keyed on go.sum / version args, ahead of the source COPY.

Fix

1. CGO dep-prewarm after go mod download:

RUN CGO_ENABLED=1 go build github.com/duckdb/duckdb-go/v2 \
    github.com/pganalyze/pg_query_go/v6 2>/dev/null || true

2. Move extension downloads before COPY . . (keyed on version args).

Net: every builder layer that costs time — module download, CGO dep
compile, extension fetch — now sits before the source COPY and caches
independently of first-party code. A source-only PR (the common case)
hits cache for all of them; the final go build recompiles only changed
packages.

Per-file

• Dockerfile: prewarm duckdb-go + pg_query_go; extension download moved up.
• Dockerfile.controlplane: prewarm pg_query_go only (CP doesn't link libduckdb; no extensions).
• Dockerfile.worker: copy go.mod/go.sum first → pin → download → prewarm → extension download → COPY source. Per-DuckDB-version pin correctness (the old copy-source-first layout) preserved by stashing the pinned go.mod/go.sum and restoring after COPY . . (local copy, no network). Binary-dependent bindings-verify stays after the build; arg-only version cross-check moved up with the downloads.
• cache-proxy Dockerfile unchanged — CGO_ENABLED=0, no C deps, no extensions.

Expected: warm-cache source-only PRs drop CGO compile (~3-5 min) + 5 extension fetches to near-zero; first build after a go.sum / extension-version bump pays it once.

Not included (deferred, separate PRs)

• PR-triggered image builds arm64-only (mw-dev is 29 arm64 / 2 amd64); keep full matrix on merge-to-main.
• Trim worker bindings download from 5 OS/arch to $TARGETARCH — now low-value since the pin+download layer is itself cached, and risks go mod tidy (which is exhaustive across GOOS/GOARCH) breakage.

🤖 Generated with Claude Code