ci: use cache path for NuGet scratch [CI]

ci/verify-backend.sh

@@ -21,6 +21,13 @@ esac
 cache="${MOSHIRO_CI_CACHE:-/home/justme/woodpecker/cache/backend-tests}"
 src="$cache/src"
 mkdir -p "$cache"
+# NuGet defaults to /tmp/NuGetScratch<user> on Linux and chmods that shared
+# path to 0700. Some Woodpecker container runtimes expose /tmp on a filesystem
+# that rejects chmod; keep NuGet's private scratch directory on the writable CI
+# cache filesystem instead. This workflow already serializes access with flock.
+export NUGET_SCRATCH="${NUGET_SCRATCH:-$cache/nuget-scratch}"
+mkdir -p "$NUGET_SCRATCH"
+chmod 700 "$NUGET_SCRATCH"
 
 # .NET 第一次运行的欢迎信息、遥测、开发证书，在每条流水线的临时 HOME 里都要白做一遍
 export DOTNET_CLI_TELEMETRY_OPTOUT=1 DOTNET_NOLOGO=1 DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1 DOTNET_GENERATE_ASPNET_CERTIFICATE=false