scripts: unify Linux native builds and retain restore caches [CI]

Build musl and glibc for amd64 and arm64 through one native package path. Reuse musl outputs for OCI images and OpenWrt installers, and export binaries inside a rootless unshare session.

Restore the executable dependency graph into a shared persistent NuGet cache, build managed dependencies once, and run isolated native publishes in parallel.

Clean temporary outputs and expired image layers under store locks, retire inactive legacy stores after seven days, and retain two toolchain exports. Add regression coverage for staging, extraction, packaging and cleanup boundaries.

.woodpecker/dev-image.yml

@@ -33,10 +33,58 @@ steps:
       RELEASE_SIGNING_KEY:
         from_secret: release_signing_key
     commands:
-      - bash ci/build-dev-image.sh backend
+      - python3 ci/run-with-timeout.py 1800 bash ci/build-dev-image.sh backend
     depends_on: []
 
-  - name: build-linux-amd64-agent
+  - name: build-musl-amd64
+    image: bash
+    environment:
+      GITEA_BASE: http://127.0.0.1:3100
+      GITEA_TOKEN:
+        from_secret: gitea_token
+      RELEASE_SIGNING_KEY:
+        from_secret: release_signing_key
+    commands:
+      - python3 ci/run-with-timeout.py 3600 bash ci/build-linux-agent.sh linux-musl-x64
+    depends_on: []
+
+  - name: build-musl-arm64
+    image: bash
+    environment:
+      GITEA_BASE: http://127.0.0.1:3100
+      GITEA_TOKEN:
+        from_secret: gitea_token
+      RELEASE_SIGNING_KEY:
+        from_secret: release_signing_key
+    commands:
+      - python3 ci/run-with-timeout.py 3600 bash ci/build-linux-agent.sh linux-musl-arm64
+    depends_on: []
+
+  - name: build-glibc-amd64
+    image: bash
+    environment:
+      GITEA_BASE: http://127.0.0.1:3100
+      GITEA_TOKEN:
+        from_secret: gitea_token
+      RELEASE_SIGNING_KEY:
+        from_secret: release_signing_key
+    commands:
+      - python3 ci/run-with-timeout.py 3600 bash ci/build-linux-agent.sh linux-x64
+    depends_on: []
+
+  - name: build-glibc-arm64
+    image: bash
+    environment:
+      GITEA_BASE: http://127.0.0.1:3100
+      GITEA_TOKEN:
+        from_secret: gitea_token
+      RELEASE_SIGNING_KEY:
+        from_secret: release_signing_key
+    commands:
+      - python3 ci/run-with-timeout.py 3600 bash ci/build-linux-agent.sh linux-arm64
+    depends_on: []
+
+  - name: publish-agent-images
     image: bash
     environment:
       GITEA_BASE: http://127.0.0.1:3100
@@ -50,42 +98,10 @@ steps:
       RELEASE_SIGNING_KEY:
         from_secret: release_signing_key
     commands:
-      - bash ci/build-dev-image.sh agent
-    depends_on: []
-
-  # Build both node architectures in parallel; publish both indexes together after both builds.
-  - name: build-linux-arm64-agent
-    image: bash
-    environment:
-      GITEA_BASE: http://127.0.0.1:3100
-      GITEA_TOKEN:
-        from_secret: gitea_token
-      ZOT_REGISTRY: registry.oeo.one
-      ZOT_USERNAME: justme
-      ZOT_SECRET:
-        from_secret: zot_secret
-      RELEASE_API_URL: https://mo.oeo.one
-      RELEASE_SIGNING_KEY:
-        from_secret: release_signing_key
-    commands:
-      - bash ci/build-dev-image.sh agent arm64
-    depends_on: []
-
-  - name: publish-linux-node-indexes
-    image: bash
-    environment:
-      ZOT_REGISTRY: registry.oeo.one
-      ZOT_USERNAME: justme
-      ZOT_SECRET:
-        from_secret: zot_secret
-      RELEASE_API_URL: https://mo.oeo.one
-      RELEASE_SIGNING_KEY:
-        from_secret: release_signing_key
-    commands:
-      - bash ci/publish-dev-node-indexes.sh
+      - python3 ci/run-with-timeout.py 900 bash ci/release-node-images.sh
     depends_on:
-      - build-linux-amd64-agent
-      - build-linux-arm64-agent
+      - build-musl-amd64
+      - build-musl-arm64
 
   - name: backend-e2e-tests
     image: bash
@@ -96,5 +112,7 @@ steps:
     commands:
       - bash ci/verify-backend.sh slow
     depends_on:
-      - publish-linux-node-indexes
+      - publish-agent-images
       - build-linux-amd64-backend
+      - build-glibc-amd64
+      - build-glibc-arm64