dockerfile: drop github-api cache-bust ADD (now 403s, redundant for pinned SHA)

The `ADD https://api.github.com/.../commits/${SHA}` line existed only to
invalidate the pip layer when a floating ref moved. GitHub's API now
returns 403 on the HF build IP, failing the build at that step. With an
explicit SHA pinned in the ARG + install URL the pip layer is already
deterministic, so the line is removed. Re-pin by bumping CADGENBENCH_SHA.

Co-authored-by: Cursor <cursoragent@cursor.com>

Dockerfile

@@ -50,11 +50,12 @@ RUN python -m ensurepip --upgrade \
 # up latest, pre-v1); lock to a commit SHA at the v1 release for
 # reproducible scores (see space-setup/post-gt-swap.md Stage F).
 ARG CADGENBENCH_SHA=289a2fc
-# Cache-bust the install below whenever the tracked ref moves (the
-# GitHub commits endpoint's response changes per commit, so BuildKit
-# re-fetches and invalidates the cached pip layer). Without it `@main`
-# stays pinned to first-build HEAD. A no-op for a fixed commit SHA.
-ADD https://api.github.com/repos/huggingface/cadgenbench/commits/${CADGENBENCH_SHA} /tmp/cadgenbench.commit
+# Pinned to an explicit commit SHA, so the pip layer below is already
+# deterministic: changing the ARG changes the install command and busts
+# the cached layer on its own. (We previously cache-busted with an
+# `ADD https://api.github.com/.../commits/${SHA}`; GitHub's API now 403s
+# on the build IP, failing the build, and it was redundant for a fixed
+# SHA -- removed. Re-pin by bumping the ARG above, not via that ADD.)
 RUN python -m pip install --no-cache-dir \
         "cadgenbench @ git+https://github.com/huggingface/cadgenbench.git@${CADGENBENCH_SHA}"