Can confirm the one-dependency shape and it is worth checking first because it is five minutes rather than a rebuild. Ours was a single package pulling a prebuilt binary for the wrong architecture, inside an image that was otherwise entirely native.
Nothing warns you, because the image itself is fine. Only that one process pays the tax, and if it happens to be the process doing the work, the whole job is ten times slower.