apt and npm layers now use --mount=type=cache so downloads persist
across builds. Consolidated three static-binary downloads into one
layer to reduce image size.

Assisted-by: GLM-5.1 via pi

diff --git a/assets/Dockerfile b/assets/Dockerfile
index 2dab9c3..745167f 100644
--- a/assets/Dockerfile
+++ b/assets/Dockerfile
@@ -1,6 +1,9 @@
 FROM node:24-trixie-slim
 
-RUN apt-get update && apt-get install -y --no-install-recommends \
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    rm -f /etc/apt/apt.conf.d/docker-clean \
+    && apt-get update && apt-get install -y --no-install-recommends \
     build-essential \
     ca-certificates \
     curl \
@@ -9,23 +12,22 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     jq \
     just \
     ripgrep \
-    && rm -rf /var/lib/apt/lists/* \
     && ln -sf /usr/bin/fdfind /usr/bin/fd
 
-RUN curl -fsSL "https://github.com/Wilfred/difftastic/releases/latest/download/difft-aarch64-unknown-linux-gnu.tar.gz" \
-      | tar xz -C /usr/local/bin difft
-
-RUN curl -fsSL "https://github.com/facebook/dotslash/releases/latest/download/dotslash-linux-musl.aarch64.tar.gz" \
-      | tar xz -C /usr/local/bin dotslash
+RUN --mount=type=cache,target=/tmp/downloads \
+    curl -fsSL "https://github.com/Wilfred/difftastic/releases/latest/download/difft-aarch64-unknown-linux-gnu.tar.gz" \
+      | tar xz -C /usr/local/bin difft \
+    && curl -fsSL "https://github.com/facebook/dotslash/releases/latest/download/dotslash-linux-musl.aarch64.tar.gz" \
+      | tar xz -C /usr/local/bin dotslash \
+    && curl -fsSL "https://github.com/kejadlen/ranger/releases/latest/download/ranger-aarch64-unknown-linux-gnu.tar.gz" \
+      | tar xz -C /usr/local/bin ranger
 
 RUN JJ_VERSION=$(curl -s https://api.github.com/repos/jj-vcs/jj/releases/latest | jq -r .tag_name) && \
     curl -fsSL "https://github.com/jj-vcs/jj/releases/download/${JJ_VERSION}/jj-${JJ_VERSION}-aarch64-unknown-linux-musl.tar.gz" \
       | tar xz --strip-components=0 -C /usr/local/bin ./jj
 
-RUN curl -fsSL "https://github.com/kejadlen/ranger/releases/latest/download/ranger-aarch64-unknown-linux-gnu.tar.gz" \
-      | tar xz -C /usr/local/bin ranger
-
-RUN npm install -g @mariozechner/pi-coding-agent
+RUN --mount=type=cache,target=/root/.npm \
+    npm install -g @mariozechner/pi-coding-agent
 
 WORKDIR /workspace