podman-compose@.service was missing the --build flag that docker-compose@.service already has (added on cube.local: /etc/systemd/system/podman-compose@.service), so removing maptool:latest before every restart (my own earlier fix, meant to force a rebuild) also destroyed the build cache along with it - every deploy was redoing apt-get/bundle install from scratch (~3 min measured, vs ~20s before). --build lets a plain systemctl restart rebuild while still reusing unchanged layers, same as docker did, so the ci.yml deploy step collapses back to one line.