Trim the stable retag step and point the cache docs at the CLI reference

imagetools create already fails when the source tag is missing, so the
separate inspect only added a registry round trip. The cache location is
documented in cli-reference.md; the Docker guide now links there and gives
only the in-image path.

Author: lelia

.github/workflows/docker-stable.yml

@@ -25,11 +25,7 @@ jobs:
           dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
           dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      # Point stable at the image the release already published instead of
-      # rebuilding it. A rebuild would pair that release's wheel with the
-      # default branch's current Dockerfile, and would give users who already
-      # pulled the release new layers to download. The retag keeps the
-      # release's attestations.
+      # Stable must be the release's exact digest, attestations included.
       - name: Tag the release image as stable
         env:
           INPUT_VERSION: ${{ inputs.version }}
@@ -38,8 +34,4 @@ jobs:
             echo "Error: '${INPUT_VERSION}' is not a release version such as 1.2.3"
             exit 1
           fi
-          if ! docker buildx imagetools inspect "socketdev/cli:${INPUT_VERSION}" > /dev/null; then
-            echo "Error: socketdev/cli:${INPUT_VERSION} is not on Docker Hub"
-            exit 1
-          fi
           docker buildx imagetools create --tag socketdev/cli:stable "socketdev/cli:${INPUT_VERSION}"

docs/ci-cd.md

@@ -539,9 +539,10 @@ docker run --rm \
 ### Cache the reachability engine
 
 With `--reach`, the CLI downloads its pinned reachability engine on first use and
-caches it under `$XDG_CACHE_HOME/socket/coana` (`/root/.cache/socket/coana` in the
-image). A new container starts with an empty cache, so without a persistent
-cache every run downloads the engine again. Mount a volume to keep it:
+caches it (see [Reachability analysis](cli-reference.md#reachability-analysis)
+for the location). In the image the cache is under `/root/.cache/socket`. A new
+container starts with an empty cache, so without a persistent cache every run
+downloads the engine again. Mount a volume to keep it:
 
 ```sh
 docker run --rm \