Drop the gha cache from PR CI

A mode=max export took the job from ~45s to ~2m on an image this small, so the
cache cost more than it saved. Back to a plain buildx run step, which is also
how security-rebuild.yml builds.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: carole-lavillonniere

.github/workflows/pr.yml

@@ -28,22 +28,17 @@ jobs:
       - name: Download CLI binaries
         run: bash downloadBinaries.sh
 
-      # amd64 only, and cached: this gates merges, so it has to be quick. The weekly
-      # rebuild is the uncached multi-arch build. Equivalent locally: make smoke-test.
+      # amd64 only: this gates merges, so it has to be quick. The weekly rebuild is
+      # the multi-arch one. Equivalent locally: make smoke-test.
       #
-      # Built through build-push-action rather than a plain `docker buildx build`
-      # run step on purpose: type=gha needs ACTIONS_RUNTIME_TOKEN, which GitHub
-      # exposes only to JS actions, so the cache flags silently no-op in a shell step.
+      # Deliberately uncached. A gha cache export costs more than it saves on a
+      # build this small, and type=gha only works from a JS action anyway, since
+      # ACTIONS_RUNTIME_TOKEN is not exposed to run: steps.
       - name: Build candidate
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        with:
-          context: .
-          file: ./Dockerfile
-          platforms: linux/amd64
-          load: true
-          tags: dde-ci:pr
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+        run: |
+          docker buildx build --load \
+            --platform linux/amd64 \
+            --tag dde-ci:pr .
 
       - name: Smoke-test candidate
         run: ./scripts/smoke-test.sh dde-ci:pr