scripts: unify Linux native builds and retain restore caches [CI]

Build musl and glibc for amd64 and arm64 through one native package path. Reuse musl outputs for OCI images and OpenWrt installers, and export binaries inside a rootless unshare session.

Restore the executable dependency graph into a shared persistent NuGet cache, build managed dependencies once, and run isolated native publishes in parallel.

Clean temporary outputs and expired image layers under store locks, retire inactive legacy stores after seven days, and retain two toolchain exports. Add regression coverage for staging, extraction, packaging and cleanup boundaries.

ci/release-linux.sh

@@ -37,6 +37,20 @@ output="$root/.release/linux-$arch/backend"
 build_root="$root/.release/build/linux-$arch-backend"
 container_context="$root/.release/container/linux-$arch"
 mkdir -p "$output" "$build_root" "$container_context/app" "$container_context/data"
+store_ready=false
+cleanup() {
+  local status=$?
+  trap - EXIT
+  if [[ "$store_ready" == true ]]; then
+    bash "$root/ci/cleanup-build-cache.sh" || echo 'warning: build cache cleanup failed' >&2
+  fi
+  if [[ "$image_publish" == true ]]; then
+    rm -rf "$output" "$build_root" "$container_context"
+    rm -f "$root/.release/auth/zot-linux-$arch.json"
+  fi
+  exit "$status"
+}
+trap cleanup EXIT
 
 # 构建信息：tag 发布用 tag，开发构建用 v<版本>-dev.<N>-<提交>（MOSHIRO_TAG 已由 ci/version.sh 设好）
 export MOSHIRO_COMMIT="${MOSHIRO_COMMIT:-${CI_COMMIT_SHA:0:10}}"
@@ -95,11 +109,14 @@ install -m 0755 "$output/moshiro-backend" "$container_context/app/moshiro-backen
 # across releases. Separate stores avoid concurrent amd64/arm64 writers.
 buildah_home="${BUILDAH_HOME:-/home/justme/woodpecker/buildah-home/$arch}"
 mkdir -p "$buildah_home"
+exec 8> "$buildah_home/.lock"
+flock -w 1800 8
 export HOME="$buildah_home"
 source "$root/ci/buildah-env.sh"
 moshiro_setup_buildah "$buildah_home"
+store_ready=true
 
-local_image="localhost/moshiro-backend:$version-$arch"
+local_image="localhost/moshiro-backend:ci-$arch"
 buildah bud --tls-verify=true --arch "$arch" \
   --build-arg "APP_VERSION=$version" \
   -f "$root/packaging/container/Backend.Containerfile" \