ci: add .NET 10 NativeAOT AotAnywhere builder [CI]

packaging/container/Agent.NativeBuild.Containerfile

@@ -1,5 +1,7 @@
 # Run all build commands on the native amd64 runner. AotAnywhere cross-links
 # the NativeAOT output, so an ARM64 build never needs QEMU.
+ARG NATIVEAOT_BUILDER_IMAGE=localhost/moshiro-dotnet10-nativeaot-aotanywhere:ci
+
 FROM --platform=linux/arm64 alpine:3.24 AS arm64-apk-keys
 
 FROM --platform=linux/amd64 alpine:3.24 AS runtime-libs
@@ -19,7 +21,7 @@ RUN set -eu; \
     for package do tar -xzf "$package" -C /tmp/runtime-root; done; \
     cp -a /tmp/runtime-root/usr/lib/*.so* /out/runtime/
 
-FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/sdk:10.0-noble-aot AS build
+FROM --platform=linux/amd64 ${NATIVEAOT_BUILDER_IMAGE} AS build
 
 WORKDIR /src/backend
 COPY restore/backend/ ./

packaging/container/NativeAot.Builder.Containerfile

@@ -0,0 +1,32 @@
+# Shared .NET 10 NativeAOT build environment for MoShiro's Linux node images.
+# The SDK image includes the Linux NativeAOT compiler prerequisites. Warm the
+# repository-pinned AotAnywhere MSBuild SDK into this image so builds do not
+# depend on a writable host-mounted NuGet cache.
+FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/sdk:10.0-noble-aot
+
+ENV DOTNET_CLI_TELEMETRY_OPTOUT=1 \
+    DOTNET_NOLOGO=1 \
+    NUGET_PACKAGES=/root/.nuget/packages
+
+WORKDIR /opt/aotanywhere
+COPY global.json ./global.json
+COPY Directory.Packages.props ./Directory.Packages.props
+COPY backend/Directory.Build.props ./backend/Directory.Build.props
+COPY backend/BannedSymbols.txt ./backend/BannedSymbols.txt
+
+WORKDIR /opt/aotanywhere/backend
+RUN printf '%s\n' \
+      '<Project Sdk="Microsoft.NET.Sdk">' \
+      '  <Sdk Name="StuDev.AotAnywhere" />' \
+      '  <PropertyGroup>' \
+      '    <TargetFramework>net10.0</TargetFramework>' \
+      '    <PublishAot>true</PublishAot>' \
+      '    <UseAotAnywhere>true</UseAotAnywhere>' \
+      '  </PropertyGroup>' \
+      '</Project>' > Warmup.csproj \
+    && dotnet restore Warmup.csproj -p:PublishAot=true -p:UseAotAnywhere=true -r linux-musl-x64 \
+    && dotnet restore Warmup.csproj -p:PublishAot=true -p:UseAotAnywhere=true -r linux-musl-arm64 \
+    && rm Warmup.csproj \
+    && rm -rf artifacts
+
+WORKDIR /src/backend

packaging/container/Probe.NativeBuild.Containerfile

@@ -1,5 +1,7 @@
 # Run all build commands on the native amd64 runner. AotAnywhere cross-links
 # the NativeAOT output, so an ARM64 build never needs QEMU.
+ARG NATIVEAOT_BUILDER_IMAGE=localhost/moshiro-dotnet10-nativeaot-aotanywhere:ci
+
 FROM --platform=linux/arm64 alpine:3.24 AS arm64-apk-keys
 
 FROM --platform=linux/amd64 alpine:3.24 AS runtime-libs
@@ -19,7 +21,7 @@ RUN set -eu; \
     for package do tar -xzf "$package" -C /tmp/runtime-root; done; \
     cp -a /tmp/runtime-root/usr/lib/*.so* /out/runtime/
 
-FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/sdk:10.0-noble-aot AS build
+FROM --platform=linux/amd64 ${NATIVEAOT_BUILDER_IMAGE} AS build
 
 WORKDIR /src/backend
 COPY restore/backend/ ./