[CI][ROCm] Avoid redundant image pulls during smoke validation

[AndreasKaratzas]

The linked AMD CI build 12440 image-build retry took 13m54s, including 339 seconds to cold-pull roughly 13 GB into host Docker even though the actual smoke checks took only 4.6 seconds. Older runs on persistent agents reused 33 of 39 layers and completed the same pull in 17–23 seconds, while the one-job Kubernetes workers observed from August 25 started with 0 of 41 host-Docker layers. The pull-based smoke path originated in #46904 and was retained while equivalent-image reuse expanded in #48646, so those PRs are relevant design origins but did not cause the abrupt August regression by themselves. Within the last two weeks, ROCm base refreshes in #53182 and #53712, plus version-sensitive Rust metadata from #52593, amplified cold-cache work; however, #53712 landed after the first slow Kubernetes run and the measured Rust work was only tens of seconds, so these were contributors rather than the sole cause. The timing transition instead aligns with BuildKit and host Docker using separate stores on fresh per-job workers, which forces the complete image graph to be downloaded a second time after BuildKit has built and pushed it. This change runs the same structural and import checks in a descendant BuildKit target and exports a build-scoped marker, eliminating the redundant transfer while retaining a Docker fallback for standalone or explicitly overridden image validation.

• Add a test_smoke Dockerfile descendant that runs the existing checks without network access and exports only a tiny marker through a scratch stage, leaving the pushed test image unchanged.
• Add smoke-test-rocm-ci to the existing Bake group with the same ROCm cache inputs and a local marker output scoped to the current Buildkite build.
• Update the Bake and smoke scripts to clean and verify that marker fail-closed, while preserving artifact-only behavior and the Docker path for explicit image overrides or fallback validation.
• Extend the existing Docker metadata test suite with graph-contract and fake-Docker behavior coverage for valid, stale, and explicitly overridden smoke paths.

AI assistance

AI assistance from OpenAI Codex was used for Buildkite log analysis, implementation, testing, review, and PR drafting. The human submitter must review every changed line, rerun or confirm the relevant checks, and be able to explain and defend the change end-to-end before marking the PR ready for review.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[AndreasKaratzas]

/ci run

[github-actions]

✅ Triggered Buildkite CI #86257 for commit 797253ccae13.