ci: retry and cache Docker dependency downloads

[THardy98]

Docker image builds download the repository Go module graph inside BuildKit, so the Go cache restored on the GitHub Actions host does not protect that step. A transient HTTP/2 failure from proxy.golang.org therefore failed an otherwise unrelated TypeScript source-worker job, and the same cold-download exposure exists in every worker and CLI Dockerfile.

This change makes that dependency layer resilient in two complementary ways. Each Dockerfile retries go mod download up to three times with short bounded backoff. GitHub Actions also uses scoped version-2 BuildKit caches for regular workers, source-built workers, the CLI image, and multi-platform publishing. Cache export is best-effort, scopes are isolated by job, language, and platform set, and runtime cache credentials remain environment-only rather than appearing in the logged Docker command.

Local builds are unchanged because cache arguments are added only when OMES_BUILDKIT_CACHE_SCOPE is set by CI. There is no runtime or deployment migration. The draft status allows the first CI cycle to validate cold-cache behavior and subsequent runs to demonstrate restored intermediate layers.

Validation:

• go test ./cmd/dev ./internal/workerctl
• actionlint workflow and expression validation
• docker buildx build --check for all seven modified Dockerfiles
• image-builder dry run confirming scoped cache arguments

Failure motivating this change: https://github.com/temporalio/omes/actions/runs/34357997033/job/102487464734