ci: bake cached toolchain into Podman agent and fix nested Buildah [CI]

packaging/container/NativeAot.Builder.Containerfile

@@ -10,23 +10,29 @@ ENV DOTNET_CLI_TELEMETRY_OPTOUT=1 \
 
 WORKDIR /opt/aotanywhere
 COPY global.json ./global.json
-COPY Directory.Packages.props ./Directory.Packages.props
-COPY backend/Directory.Build.props ./backend/Directory.Build.props
-COPY backend/BannedSymbols.txt ./backend/BannedSymbols.txt
-
-WORKDIR /opt/aotanywhere/backend
+ARG AOTANYWHERE_VERSION=1.0.5
+ARG ZIG_TOOLSET_VERSION=0.16.0.2
+# Only SDK/tool versions affect this layer. Application versions and sources
+# must not invalidate the expensive toolchain downloads on every pipeline.
 RUN printf '%s\n' \
       '<Project Sdk="Microsoft.NET.Sdk">' \
-      '  <Sdk Name="StuDev.AotAnywhere" />' \
+      "  <Sdk Name=\"StuDev.AotAnywhere\" Version=\"$AOTANYWHERE_VERSION\" />" \
       '  <PropertyGroup>' \
       '    <TargetFramework>net10.0</TargetFramework>' \
+      '    <OutputType>Exe</OutputType>' \
       '    <PublishAot>true</PublishAot>' \
       '    <UseAotAnywhere>true</UseAotAnywhere>' \
+      '    <NuGetAudit>false</NuGetAudit>' \
       '  </PropertyGroup>' \
+      '  <ItemGroup>' \
+      "    <PackageReference Include=\"Vezel.Zig.Toolsets.linux-x64\" Version=\"$ZIG_TOOLSET_VERSION\" GeneratePathProperty=\"true\" />" \
+      '  </ItemGroup>' \
       '</Project>' > Warmup.csproj \
     && dotnet restore Warmup.csproj -p:PublishAot=true -p:UseAotAnywhere=true -r linux-musl-x64 \
     && dotnet restore Warmup.csproj -p:PublishAot=true -p:UseAotAnywhere=true -r linux-musl-arm64 \
+    && dotnet restore Warmup.csproj -p:PublishAot=true -p:UseAotAnywhere=true -r linux-x64 \
+    && dotnet restore Warmup.csproj -p:PublishAot=true -p:UseAotAnywhere=true -r linux-arm64 \
     && rm Warmup.csproj \
-    && rm -rf artifacts
+    && rm -rf bin obj
 
 WORKDIR /src/backend