dockerfile: build cadgenbench from main with commit-endpoint cache-bust

Track @main pre-v1 and re-fetch the GitHub commits endpoint so BuildKit
invalidates the pip layer whenever main moves (no more first-build pin).

Co-authored-by: Cursor <cursoragent@cursor.com>

Dockerfile

@@ -45,10 +45,16 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 RUN python -m ensurepip --upgrade \
     && python -m pip install --no-cache-dir --upgrade pip
 
-# cadgenbench from the Public GitHub repo, same convention and
-# ARG name as the leaderboard Dockerfile. Bump CADGENBENCH_SHA in
-# lockstep with cadgenbench releases.
-ARG CADGENBENCH_SHA=b22a53c
+# cadgenbench from the Public GitHub repo, same convention and ARG name
+# as the leaderboard Dockerfile. Defaults to `main` (every rebuild picks
+# up latest, pre-v1); lock to a commit SHA at the v1 release for
+# reproducible scores (see space-setup/post-gt-swap.md Stage F).
+ARG CADGENBENCH_SHA=main
+# Cache-bust the install below whenever the tracked ref moves (the
+# GitHub commits endpoint's response changes per commit, so BuildKit
+# re-fetches and invalidates the cached pip layer). Without it `@main`
+# stays pinned to first-build HEAD. A no-op for a fixed commit SHA.
+ADD https://api.github.com/repos/huggingface/cadgenbench/commits/${CADGENBENCH_SHA} /tmp/cadgenbench.commit
 RUN python -m pip install --no-cache-dir \
         "cadgenbench @ git+https://github.com/huggingface/cadgenbench.git@${CADGENBENCH_SHA}"