perf(build): keep test suites out of the image and cache CI builds durably

Three build-time improvements, all measured on this host.

The build context no longer ships the test suites. `next build` type-checks
the whole project, so `e2e/` and `integration/` in the context made the image
build fail on a type error in test code and pulled @playwright/test, vitest,
msw, testcontainers and drizzle-kit into the image. The CI runs those suites
on the host. Type-check time in the build drops from 2.2s to 1.3s, and a
contract test now fails if application code ever imports from those folders.

The CI now exports the build cache to a directory outside the runner
workspace: /var/cache/epicnext-cms-buildcache for the release and a separate
map for branch preflights, so a branch can never feed the release cache. The
workspace is wiped after every job and `docker builder prune` runs after
every release, so the next build started with an empty cache and downloaded
all 493 packages again (measured: reused 0, downloaded 493). With the
durable export the frozen dependency layer is reused (measured: reused 493,
downloaded 0) even after a full prune. A cache directory that is not
writable only produces a warning; the release is never blocked.

Investigated the remaining ~30s of Next.js build tracing: excluding the
dev-only packages with `outputFileTracingExcludes` made it slower (35s vs
30s), because the traced output was already minimal (5 packages). The cost
is Next's own page-config collection and file tracing over 329 routes, not
the dependency set, so no configuration was kept.

scripts/ci-preflight.sh

@@ -39,6 +39,23 @@ pnpm exec playwright install chromium
 export NEWS_E2E_IMAGE="$image"
 export NEWS_E2E_RELEASE="$sha"
 build_attempted=1
+# Duurzame buildcache buiten de tijdelijke werkmap, zodat de lagen van een
+# vorige preflight hergebruikt worden in plaats van opnieuw gedownload. Eigen
+# map, gescheiden van de release-cache: een branch-preflight mag nooit de cache
+# van de release-build voeden. Een lege CMS_BUILD_CACHE_DIR schakelt het uit.
+build_cache_dir="${CMS_BUILD_CACHE_DIR-/var/cache/epicnext-cms-preflight-cache}"
+build_cache_flags=()
+if [ -n "$build_cache_dir" ]; then
+  if mkdir -p "$build_cache_dir" 2>/dev/null && [ -w "$build_cache_dir" ]; then
+    build_cache_flags=(
+      --cache-from "type=local,src=$build_cache_dir"
+      --cache-to "type=local,dest=$build_cache_dir,mode=max"
+    )
+  else
+    echo "Warning: buildcache $build_cache_dir is niet beschrijfbaar; build zonder hergebruikte cache." >&2
+  fi
+fi
 DOCKER_BUILDKIT=1 docker build --progress=plain \
+  ${build_cache_flags[@]+"${build_cache_flags[@]}"} \
   --build-arg NEXT_DEPLOYMENT_ID="$sha" -t "$image" .
 NEWS_E2E_IMAGE="$image" NEWS_E2E_RELEASE="$sha" node --import tsx e2e/news-real/run.ts