fix(ci): docker_build_push 缓存损坏重建改为 flock 串行 + 健康度复查，避免并发互删

scripts/ci/docker_build_push.sh

@@ -85,13 +85,29 @@ build_with_cache_retry() {
       echo "$build_output"
       echo ""
       echo "⚠️  builder 缓存异常，重建持久 builder 后重试 (attempt $attempt/$max_attempts)..."
-      docker buildx rm "$BUILDER_NAME" >/dev/null 2>&1 || true
-      docker buildx create --name "$BUILDER_NAME" --driver docker-container \
-        --driver-opt network=host \
-        --buildkitd-flags "--allow-insecure-entitlement network.host" \
-        --platform linux/amd64
-      docker buildx use "$BUILDER_NAME"
-      docker buildx inspect "$BUILDER_NAME" --bootstrap
+      # 共享 builder 的重建必须串行：ci-builder-persist 被所有 build job 共用，
+      # 若 job A 正在构建、job B 检测到损坏直接 rm，会把 A 正在用的 buildkit 杀掉。
+      # 用 flock 串行化重建；拿到锁后再次检查 builder 健康度，已被别的 job 重建则直接复用。
+      LOCK_FILE="/tmp/ci-builder-persist-rebuild.lock"
+      exec 9>"$LOCK_FILE"
+      echo "🔒 等待重建锁（最多 120s）..."
+      if flock -w 120 9; then
+        if docker buildx inspect "$BUILDER_NAME" --bootstrap >/dev/null 2>&1; then
+          echo "✅ builder 已被其他并发 job 重建/恢复，直接复用"
+        else
+          echo "🔨 锁内重建持久 builder..."
+          docker buildx rm "$BUILDER_NAME" >/dev/null 2>&1 || true
+          docker buildx create --name "$BUILDER_NAME" --driver docker-container \
+            --driver-opt network=host \
+            --buildkitd-flags "--allow-insecure-entitlement network.host" \
+            --platform linux/amd64
+          docker buildx use "$BUILDER_NAME"
+          docker buildx inspect "$BUILDER_NAME" --bootstrap
+        fi
+      else
+        echo "⚠️ 等待重建锁超时，直接重试 build（失败将重试/--no-cache）"
+        docker buildx use "$BUILDER_NAME" 2>/dev/null || true
+      fi
       attempt=$((attempt + 1))
     else
       echo "$build_output"