> More importantly, on CI systems it’s relatively common to check out code using git, and git doesn’t care about mtime

git doesn't care about mtime, but git maintains trees whose hash changes if any constituent part of the tree changes. It'd seem tempting to check for a .git and if present use the git tree to determine whether to invalidate the cache.