ci: bake cached toolchain into Podman agent and fix nested Buildah [CI]

ci/buildah-env.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Explicit storage paths also work when a rootless Podman agent runs as UID 0
+# inside its user namespace. Changing HOME alone then selects the system store.
+moshiro_setup_buildah() {
+  local store_home="${1:?Buildah cache directory is required}"
+  local config="$store_home/.config/containers/moshiro-storage.conf"
+  local key runroot
+  key="$(printf '%s' "$store_home" | sha256sum | cut -c1-16)"
+  runroot="${XDG_RUNTIME_DIR:-/tmp}/moshiro-buildah-$(id -u)/$key"
+  mkdir -p "$store_home/.local/share/containers/storage" "$(dirname "$config")" "$runroot"
+  (
+    umask 077
+    printf '[storage]\ndriver = "%s"\ngraphroot = "%s"\nrunroot = "%s"\n' \
+      "${STORAGE_DRIVER:-overlay}" "$store_home/.local/share/containers/storage" "$runroot" > "$config"
+  )
+  chmod 700 "$runroot"
+  export CONTAINERS_STORAGE_CONF="$config"
+  # The outer Podman container provides the user namespace and capabilities;
+  # RUN does not need a second OCI runtime or nested cgroup management.
+  export BUILDAH_ISOLATION="${BUILDAH_ISOLATION:-chroot}"
+  buildah info >/dev/null
+  echo "Buildah store: $store_home/.local/share/containers/storage ($BUILDAH_ISOLATION)"
+}