scripts: unify Linux native builds and retain restore caches [CI]

Build musl and glibc for amd64 and arm64 through one native package path. Reuse musl outputs for OCI images and OpenWrt installers, and export binaries inside a rootless unshare session.

Restore the executable dependency graph into a shared persistent NuGet cache, build managed dependencies once, and run isolated native publishes in parallel.

Clean temporary outputs and expired image layers under store locks, retire inactive legacy stores after seven days, and retain two toolchain exports. Add regression coverage for staging, extraction, packaging and cleanup boundaries.

ci/cleanup-retired-stores.py

@@ -0,0 +1,44 @@
+#!/usr/bin/env python3
+"""Remove inactive stores retired by the unified Linux build pipeline."""
+import fcntl
+from pathlib import Path
+import shutil
+import sys
+import time
+
+
+def cleanup(base: Path) -> list[str]:
+    names = [f'dev-image-build-noble-aot-v1-{role}-{arch}'
+             for role in ('agent', 'probe') for arch in ('amd64', 'arm64')]
+    names += ['dev-node-index-agent', 'dev-node-index-probe', 'node-images']
+    removed = []
+    cutoff = time.time() - 7 * 86400
+    for name in names:
+        store = base / name
+        if store.is_symlink() or not store.is_dir():
+            continue
+        try:
+            with (store / '.lock').open('a') as lock:
+                try:
+                    fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
+                except BlockingIOError:
+                    continue
+                graph = store / '.local/share/containers/storage'
+                # Every image/container/layer creation updates these storage metadata
+                # files. Check all drivers, including an older vfs store.
+                activity = [p.stat().st_mtime for pattern in ('*-images/images.json',
+                            '*-containers/containers.json', '*-layers/layers.json')
+                            for p in graph.glob(pattern)]
+                if not activity or max(activity) >= cutoff:
+                    continue
+                shutil.rmtree(store)
+                removed.append(name)
+        except FileNotFoundError:
+            # Another store's cleanup may have finished first.
+            continue
+    return removed
+
+
+if __name__ == '__main__':
+    for name in cleanup(Path(sys.argv[1])):
+        print('removed inactive retired build store:', name)