fix: rewrite tar extract onto target volumes root when it is a cross-device symlink

Hosts like rpc-us-32 put /var/lib/docker (or volumes/) on another mount;
tar -C / then EXDEV on every var/lib/docker/volumes/... member. Canonicalize
the deepest static prefix (readlink -f /var/lib/docker/volumes) and append a
--transform after SLOWDISK_TRANSFORMS. Keying only on /var/lib/docker misses
a real docker root with volumes/ as the symlink. No-op on normal hosts.
Per-volume _data static-file offload stays on SLOWDISK_TRANSFORMS.

Co-authored-by: Cursor <cursoragent@cursor.com>

volume-utils.sh

@@ -294,3 +294,32 @@ delete_slowdisk_targets_for_key() {
   done
   shopt -u nullglob
 }
+
+# Echo a tar --transform fragment (leading space + quoted --transform=...) that
+# rewrites archive members from var/lib/docker/volumes/... onto the TARGET's
+# real volumes root when that path is a cross-device symlink (EXDEV under
+# tar -C /). Key on the DEEPEST static prefix — readlink -f
+# /var/lib/docker/volumes — so we cover symlinks at /var, /var/lib,
+# /var/lib/docker, OR /var/lib/docker/volumes itself (canonicalizing only
+# /var/lib/docker misses a real dir with volumes/ as the symlink).
+# Reproduced rpc-us-32 2026-07-15/18: /var on sda4, /var/lib/docker -> /docker
+# on md0 → volumes resolves to /docker/volumes. Empty when readlink -f
+# returns /var/lib/docker/volumes itself (no-op).
+# Requires SSH_CMD + DEST_HOST (set by clone-*/cache-deploy after multiplexing).
+# Must be appended AFTER any SLOWDISK_TRANSFORMS — tar applies transforms in
+# order; slowdisk-rewritten members start with slowdisk/ and must not be
+# re-touched, while remaining var/lib/docker/volumes/... members still need
+# the rewrite. Per-volume _data static-file symlinks onto /slowdisk remain the
+# SLOWDISK_TRANSFORMS mechanism — this helper only relocates the volumes root.
+# Quoting follows the SLOWDISK_TRANSFORMS '|'-delimiter + single-quote pattern
+# so the script-file listener heredoc expands once without mangling the regex.
+docker_root_transform() {
+  local real
+  real=$($SSH_CMD "$DEST_HOST" "readlink -f /var/lib/docker/volumes" 2>/dev/null || true)
+  real="${real%/}"
+  if [[ -z "$real" || "$real" == "/var/lib/docker/volumes" ]]; then
+    return 0
+  fi
+  local rel="${real#/}"
+  echo " --transform='s|^\\(\\./\\)\\?var/lib/docker/volumes/|${rel}/|'"
+}