feat(build): raise BuildKit cache-mount budget for remote builders

BuildKit's default GC caps the ephemeral cache tier (RUN
--mount=type=cache mounts, local context, git checkouts) at a hardcoded
512 MB.
Across the 7-distro build matrix that fills instantly and forces
re-downloads of system and R packages on every rebuild.

Add docker/buildkitd.toml and pass it via --config when creating the
docker-container builders (artemis/amd64, gaia/arm64):

- cache-mount tier raised 512 MB -> 8 GB, retained 7 days
- total cache bounded at 40 GB with 20 GB min-free (safe on the
  disk-tight Hetzner host, modest on the Mac mini)

Limits are absolute rather than percentages because the two hosts differ
~6x in free space. Document the --config flag in the justfile so a future
recreate does not silently revert to the 512 MB default.

justfile

@@ -10,8 +10,10 @@
 #   - buildx builders named `artemis` (amd64) and `gaia` (arm64), created with the
 #     docker-container driver (runs BuildKit on the remote host's docker daemon over
 #     SSH). The default `remote` driver does NOT work with an ssh:// docker host.
-#       docker buildx create --name artemis --driver docker-container ssh://<user@host-amd64>
-#       docker buildx create --name gaia    --driver docker-container ssh://<user@host-arm64>
+#     Pass --config docker/buildkitd.toml so BuildKit's GC keeps a usable cache
+#     (the default caps the cache-mount tier at 512 MB, forcing re-downloads).
+#       docker buildx create --name artemis --driver docker-container --config docker/buildkitd.toml ssh://<user@host-amd64>
+#       docker buildx create --name gaia    --driver docker-container --config docker/buildkitd.toml ssh://<user@host-arm64>
 #   - exported secrets: B2_S3_ACCESS_KEY, B2_S3_SECRET_KEY, PGPASS (GITHUB_PAT optional)
 #
 # Overridable (env or `just VAR=… rebuild …`):