A bit of an update, in case anyone else bumps into this. Takayuki kindly replied to my ticket, to say that the CircleCI Docker Layer Caching feature would help. Sadly I don’t have budget sign-off for the necessary plan, but I wonder whether that just masks an intermittent problem, rather than fixing it.
However, that does make me wonder whether layer caching would make it more reliable, even if that is “cheating” on the problem. If I get some spare engineering time, I might look at my old sticky-tape solution.
In the short term, I am happy to just re-run failed builds.