[deploy] Dockerfile manifest-first caching comment is misleading — dep cache invalidated on any source change

[obchain]

PR: #55 (feat/27-docker-compose)
Files: Dockerfile lines 19-31

The Dockerfile comment states:

Manifests first so the dep layer caches separately from source. Dummy src/main.rs is cheaper than copying the full workspace when only Cargo.* changes.

However the actual layer sequence is:

COPY Cargo.toml Cargo.lock ./
COPY crates ./crates           # entire source tree in one layer
RUN --mount=type=cache ...
    cargo build --locked --release --bin charon

There is no dummy-src step. COPY crates ./crates copies the entire source tree before the build. Any change to any file in any crate — including test files, doc comments, or non-binary library crates — invalidates the COPY crates layer, which in turn forces a full recompile. The BuildKit --mount=type=cache mounts persist the target/ directory across independent builds on the same host but do not help when the copy layer above changes.

The comment promises behavior that is not implemented. On first deploy or after a Cargo.lock update, full dependency compilation from scratch takes 5-15 minutes on a CX22 2 vCPU machine.

Suggested fix: Either implement the advertised dummy-src pattern (create stub src/main.rs per crate after copying manifests, build deps, then COPY real source and rebuild), or use cargo-chef (LukeMathWalker/cargo-chef) which handles this automatically for multi-crate workspaces. At minimum, remove the misleading comment so operators do not expect fast incremental rebuilds.

Refs #55

[obchain]

Fixed in 8fe1c6d — Dockerfile cache comment rewritten to match layer reality (BuildKit target-mount is the real incremental mechanism; Cargo.lock still triggers full dep recompile).