refactor(ci): build oab binary once per arch, fan out lightweight packaging (#1242)

Previously, all 30 matrix jobs (15 agents × 2 architectures) each ran
a full Docker multi-stage build that compiled the Rust binary from
source. Even with GHA cache, the builder stage was duplicated across
30 separate cache scopes.

This refactor:
- Adds a 'compile' job (2 parallel: amd64 + arm64) that builds
  openab, openab-agent, and agy-acp binaries and uploads as artifact
- Introduces Dockerfile.package that copies pre-built binaries
  (COPY --from=bins) instead of compiling from source
- The 'build' matrix jobs now only do lightweight image packaging
  (install agent CLI + copy binary), no Rust compilation

Co-authored-by: chaodu-agent <chaodu-agent@openab.dev>

Author: chaodu-agent

.github/workflows/pre-beta-build.yml

@@ -35,8 +35,6 @@ jobs:
               return;
             }
             // Scheduled run: build only if main got a commit in the last ~70min.
-            // 70 (not 60) absorbs GitHub's cron scheduling drift so a commit just
-            // before the hour isn't missed when the run fires a few minutes late.
             const since = new Date(Date.now() - 70 * 60 * 1000).toISOString();
             const { data: commits } = await github.rest.repos.listCommits({
               owner: context.repo.owner,
@@ -68,8 +66,69 @@ jobs:
           echo "agents=${JSON}" >> "$GITHUB_OUTPUT"
           echo "Building: $AGENTS"
 
+  # ---------------------------------------------------------------------------
+  # Compile openab (and openab-agent, agy-acp) once per architecture.
+  # Uploads pre-built binaries as artifacts for the packaging jobs.
+  # ---------------------------------------------------------------------------
+  compile:
+    needs: [gate, matrix]
+    if: needs.gate.outputs.should_run == 'true'
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - { os: linux/amd64, runner: ubuntu-latest, arch: amd64 }
+          - { os: linux/arm64, runner: ubuntu-24.04-arm, arch: arm64 }
+    runs-on: ${{ matrix.platform.runner }}
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache cargo registry & target
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: compile-${{ matrix.platform.arch }}-${{ hashFiles('Cargo.lock') }}
+          restore-keys: |
+            compile-${{ matrix.platform.arch }}-
+
+      - name: Build openab
+        run: cargo build --release --features unified
+
+      - name: Build openab-agent
+        run: cd openab-agent && printf '\n[workspace]\n' >> Cargo.toml && cargo build --release
+
+      - name: Build agy-acp
+        run: cd agy-acp && printf '\n[workspace]\n' >> Cargo.toml && cargo build --release
+
+      - name: Collect binaries
+        run: |
+          mkdir -p bins
+          cp target/release/openab bins/
+          cp openab-agent/target/release/openab-agent bins/
+          cp agy-acp/target/release/agy-acp bins/
+
+      - name: Upload binaries
+        uses: actions/upload-artifact@v4
+        with:
+          name: openab-bins-${{ matrix.platform.arch }}
+          path: bins/
+          if-no-files-found: error
+          retention-days: 1
+
+  # ---------------------------------------------------------------------------
+  # Package: build lightweight Docker images (no Rust compilation).
+  # Downloads pre-built binaries and uses Dockerfile.package.
+  # ---------------------------------------------------------------------------
   build:
-    needs: matrix
+    needs: [matrix, compile]
     strategy:
       fail-fast: false
       matrix:
@@ -84,6 +143,15 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Download pre-built binaries
+        uses: actions/download-artifact@v4
+        with:
+          name: openab-bins-${{ matrix.platform.arch }}
+          path: bin
+
+      - name: Make binaries executable
+        run: chmod +x bin/*
+
       - uses: docker/setup-buildx-action@v3
 
       - uses: docker/login-action@v4
@@ -97,13 +165,14 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
-          file: Dockerfile.unified
+          file: Dockerfile.package
           target: ${{ matrix.agent }}
+          build-contexts: bins=bin
           platforms: ${{ matrix.platform.os }}
           outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
           cache-from: |
-            type=gha,scope=pre-beta-${{ matrix.agent }}-${{ matrix.platform.arch }}
-          cache-to: type=gha,scope=pre-beta-${{ matrix.agent }}-${{ matrix.platform.arch }},mode=max
+            type=gha,scope=pre-beta-pkg-${{ matrix.agent }}-${{ matrix.platform.arch }}
+          cache-to: type=gha,scope=pre-beta-pkg-${{ matrix.agent }}-${{ matrix.platform.arch }},mode=max
 
       - name: Export digest
         run: |