ci: bake cached toolchain into Podman agent and fix nested Buildah [CI]

ci/nativeaot-toolchain.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+moshiro_nativeaot_settings() {
+  local repo_root="${1:?repository root}"
+  read -r MOSHIRO_AOTANYWHERE_VERSION MOSHIRO_ZIG_TOOLSET_VERSION < <(python3 - "$repo_root" <<'PY'
+import json, sys, xml.etree.ElementTree as ET
+from pathlib import Path
+root = Path(sys.argv[1])
+aot = json.loads((root / 'global.json').read_text())['msbuild-sdks']['StuDev.AotAnywhere']
+zig = next(p.attrib['VersionOverride'] for p in ET.parse(root / 'backend/Directory.Build.props').iter('PackageReference') if p.attrib.get('Include') == 'Vezel.Zig.Toolsets.linux-x64')
+print(aot, zig)
+PY
+)
+  MOSHIRO_NATIVEAOT_BUILDER_KEY="$(
+    { cat "$repo_root/global.json" "$repo_root/packaging/container/NativeAot.Builder.Containerfile";
+      printf '%s\n' "$MOSHIRO_AOTANYWHERE_VERSION" "$MOSHIRO_ZIG_TOOLSET_VERSION"; } \
+      | tr -d '\r' | sha256sum | cut -d' ' -f1
+  )"
+}