fix(ci): avoid recursive Next.js cache hashing

[pandemicsyn]

The Next.js build job can fail before compilation because its cache key recursively hashes JavaScript and TypeScript files after dependencies are installed. The main run at 6ccb257c9 hit the 120-second hashFiles limit.

Use the root lockfile hash and commit SHA for the cache key. Keep the lockfile-based restore prefix so builds can reuse the previous incremental cache without scanning the dependency tree.

Validation: workflow YAML parsing, changed-file formatting, and git diff --check passed. The application build was not rerun locally; the existing paths filter skips it for workflow-only changes.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The workflow-only change safely replaces recursive source hashing in the Next.js cache key with the root lockfile hash and commit SHA, preserving incremental-cache reuse via the lockfile-scoped restore prefix; no defects found.

Files Reviewed (1 file)

• .github/workflows/ci.yml

---

_{Reviewed by deepseek-v4.1-flash · Input: 23.8K · Output: 5K · Cached: 194.6K}

_{Review guidance: REVIEW.md from base branch main}