ci: add .NET 10 NativeAOT AotAnywhere builder [CI]

ci/build-dev-image.sh

@@ -102,12 +102,19 @@ context="$work/$component"
 local_image="localhost/moshiro-$component:dev-$arch-check"
 node_rid="linux-musl-x64"
 [[ "$arch" == arm64 ]] && node_rid="linux-musl-arm64"
-# Keep writable NuGet caches isolated per parallel build (component + arch).
-# Reuse still applies across pipeline runs without concurrent restore races.
-# Keep the package cache across Buildah storage generations so refreshing a
-# damaged layer store does not force another full NuGet download.
-nuget_cache="/home/justme/woodpecker/buildah-home/dev-image-build-$component-$arch/nuget-packages"
-mkdir -p "$nuget_cache"
+# Build a dedicated .NET 10 NativeAOT/AotAnywhere environment in this isolated
+# Buildah store. Keeping NuGet inside image layers avoids a shared writable
+# package mount being corrupted by canceled or parallel builds.
+builder_image="localhost/moshiro-dotnet10-nativeaot-aotanywhere:ci"
+builder_context="$work/nativeaot-builder"
+mkdir -p "$builder_context/backend"
+install -m 0644 "$root/global.json" "$builder_context/global.json"
+install -m 0644 "$root/Directory.Packages.props" "$builder_context/Directory.Packages.props"
+install -m 0644 "$root/backend/Directory.Build.props" "$builder_context/backend/Directory.Build.props"
+install -m 0644 "$root/backend/BannedSymbols.txt" "$builder_context/backend/BannedSymbols.txt"
+run_bounded 30m buildah bud --layers --network host --tls-verify=true --arch amd64 \
+  -f "$root/packaging/container/NativeAot.Builder.Containerfile" \
+  -t "$builder_image" "$builder_context"
 
 # A stable timestamp lets a retry of the same commit reuse the publish layer.
 commit_epoch="$(git -C "$root" show -s --format=%ct "$CI_COMMIT_SHA")"
@@ -115,7 +122,7 @@ built_at="$(date -u -d "@$commit_epoch" +%Y-%m-%dT%H:%M:%SZ)"
 
 python3 "$root/ci/stage-node-image.py" "$component" "$context"
 run_bounded 30m buildah bud --layers --network host --tls-verify=true --arch "$arch" \
-  --volume "$nuget_cache:/root/.nuget/packages:rw" \
+  --build-arg "NATIVEAOT_BUILDER_IMAGE=$builder_image" \
   --build-arg "APP_VERSION=$image_version" \
   --build-arg "NODE_RID=$node_rid" \
   --build-arg "MOSHIRO_TAG=$MOSHIRO_TAG" --build-arg "MOSHIRO_COMMIT=${CI_COMMIT_SHA:0:10}" --build-arg "MOSHIRO_BUILT_AT=$built_at" \