Install verified font directly to avoid APT cache filename mismatch

Dockerfile

@@ -14,9 +14,8 @@ RUN --mount=type=bind,source=build-cache/debs,target=/build-debs,readonly sed -i
          font_sha=$(apt-cache show "fonts-noto-cjk=$font_version" | awk '$1=="SHA256:" {print $2;exit}'); \
          test -n "$font_sha"; \
          echo "$font_sha  /build-debs/fonts-noto-cjk.deb" | sha256sum -c -; \
-         cp /build-debs/fonts-noto-cjk.deb "/var/cache/apt/archives/fonts-noto-cjk_${font_version#*:}_all.deb"; \
-       fi \
-    && apt-get install -y --no-install-recommends fonts-noto-cjk tzdata \
+         apt-get install -y --no-install-recommends /build-debs/fonts-noto-cjk.deb tzdata; \
+       else apt-get install -y --no-install-recommends fonts-noto-cjk tzdata; fi \
     && rm -rf /var/lib/apt/lists/* \
     && groupadd --gid 10333 frameflow && useradd --uid 10333 --gid 10333 --no-create-home frameflow \
     && mkdir -p /data/images /data/generated /data/cache /config \

docs/NAS.md

@@ -121,7 +121,7 @@ from a trusted download machine. Verify its manifest, compressed blob SHA-256 an
 all uncompressed rootfs diff IDs before loading. With the verified local tag loaded:
 
 ```sh
-sudo env DOCKER_BUILDKIT=0 /usr/local/bin/docker compose build \
+sudo env DOCKER_BUILDKIT=1 /usr/local/bin/docker compose build \
   --build-arg PYTHON_BASE=python:3.14.5-slim-bookworm
 ```