ci: bake cached toolchain into Podman agent and fix nested Buildah [CI]

packaging/container/Woodpecker.Agent.Containerfile

@@ -0,0 +1,33 @@
+ARG NATIVEAOT_BUILDER_IMAGE=localhost/moshiro-dotnet10-nativeaot-aotanywhere:ci
+FROM docker.io/library/node:24-bookworm-slim AS node
+FROM quay.io/woodpeckerci/woodpecker-agent:v3.18.1 AS agent
+FROM docker.io/woodpeckerci/plugin-git:2.6.0 AS clone
+FROM ${NATIVEAOT_BUILDER_IMAGE}
+
+# Installed once when this image changes, never in a pipeline step.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+      buildah fuse-overlayfs uidmap runc python3 git git-lfs openssh-client \
+      curl ca-certificates openssl util-linux binutils xz-utils unzip make \
+      clang lld zlib1g-dev libssl-dev \
+    && rm -rf /var/lib/apt/lists/*
+COPY --from=node /usr/local/ /usr/local/
+COPY --from=agent /bin/woodpecker-agent /usr/local/bin/woodpecker-agent
+COPY --from=clone /bin/plugin-git /usr/local/bin/plugin-git
+
+# Test sidecars are also downloaded into a reusable image layer.
+COPY ci/fetch-quic-test-runtime.sh /opt/moshiro/fetch-quic-test-runtime.sh
+RUN bash /opt/moshiro/fetch-quic-test-runtime.sh /opt/moshiro/quic
+COPY ci/woodpecker-agent-entrypoint.sh /usr/local/bin/moshiro-ci-entrypoint
+RUN chmod 0755 /usr/local/bin/moshiro-ci-entrypoint
+
+ENV WOODPECKER_IN_CONTAINER=true \
+    WOODPECKER_BACKEND=local \
+    WOODPECKER_AGENT_LABELS=ci=domain-linux-native \
+    WOODPECKER_BACKEND_LOCAL_TEMP_DIR=/home/justme/woodpecker/work \
+    MOSHIRO_QUIC_TEST_RUNTIME=/opt/moshiro/quic/runtime \
+    NUGET_SCRATCH=/home/justme/woodpecker/cache/nuget/scratch \
+    NUGET_PACKAGES=/home/justme/woodpecker/cache/nuget/packages \
+    BUILDAH_ISOLATION=chroot
+WORKDIR /home/justme/woodpecker
+ENTRYPOINT ["/usr/local/bin/moshiro-ci-entrypoint"]