history: finalize export records on their owning node

[crazy-max]

needs #3724
fixes docker/build-push-action#1388
closes #3344
closes docker/build-push-action#1392
closes docker/bake-action#336

This fixes history export --finalize for multi-node builders such as the Kubernetes driver.

The failure happens when the same logical build ref appears more than once in history, once per node, and export finalization is not applied to the node that owns the selected record. In that case Buildx can later try to export a record whose trace descriptor is still not readable and fail with NotFound while loading the trace descriptor:

+ docker buildx --builder=buildx-test-c882461ff920a3349084436f290222c8 history ls
}BUILD ID                    NAME                       STATUS      CREATED AT               DURATION   
kh4h2q8qavh3iqe7bvpz869gy   buildx-output.PdsmBG11XK   Completed   Less than a second ago   0.2s       
z8xx18nyoptmh8l0ylyo5bqat   buildx-output.PdsmBG11XK   Completed   1 second ago             1.1s       
z8xx18nyoptmh8l0ylyo5bqat   buildx-output.PdsmBG11XK   Completed   1 second ago             0.9s       
+ docker buildx --builder=buildx-test-c882461ff920a3349084436f290222c8 history export --finalize --all --output /tmp/buildx-output.PdsmBG11XK/records.dockerbuild
ERROR: failed to export: failed to export record: failed to load trace descriptor: failed to get info: NotFound: rpc error: code = NotFound desc = content digest sha256:c257101ad2a226de341bdab5149018946bbea30e8290135b15c9ccf5755f5f60: not found

This keeps the existing finalize behavior for records that do not yet expose a trace descriptor, but changes finalization to follow record ownership. Buildx now deduplicates selected records by (ref, node), sends finalize to the owning node for each selected record, re-queries records before export, and collapses duplicate per-node entries down to one logical record per ref.

It also fixes bundle export to use all available node content stores instead of stopping at the first one. That allows the exported records to resolve their referenced content correctly across multi-node builders during archive creation.

[crazy-max]

Hum still fails, looking at the logs: https://github.com/docker/buildx/actions/runs/22947651040/job/66604243143?pr=3716#step:9:321

+ docker buildx --builder=buildx-test-30a7ab764361dd1f4482285765e20405 history ls
}BUILD ID                    NAME                       STATUS      CREATED AT               DURATION   
0v82njsviycrtwp3hicwi7ma1   buildx-output.9R23X274Na   Completed   Less than a second ago   0.1s       
i2hwfladqm5qikdpkv1tqrd7x   buildx-output.9R23X274Na   Completed   1 second ago             1.2s       
i2hwfladqm5qikdpkv1tqrd7x   buildx-output.9R23X274Na   Completed   1 second ago             1.0s       
+ docker buildx --builder=buildx-test-30a7ab764361dd1f4482285765e20405 history export --finalize --all --output /tmp/buildx-output.9R23X274Na/records.dockerbuild
ERROR: failed to export: failed to export record: failed to load trace descriptor: failed to get info: NotFound: rpc error: code = NotFound desc = content digest sha256:da1a7755c4ee696f92ea39b1f92465e758d344f0ac6262061c21dea33432d81e: not found

history ls shows the same build ref twice, once per node. That means export is trying to bundle per-node records for a multi-node build, and one node is advertising a trace digest that its content store still cannot serve or smth around that?

[tonistiigi]

selected -> toExport
prefixLen -> recCount

[tonistiigi]

Not sure I understand this. Multi-node build still has two separate history records with different data. If you are dropping one node here, the data from another node still gets dropped from the export.

[crazy-max]

Ah yes you're right, I was treating duplicate refs as alternative candidates for the same logical record, but bundle.Export does not merge them. It exports one manifest per input record.