fix(quic): merge static MsQuic support with latest main [CI]

ci/build-dev-image.sh

@@ -84,6 +84,11 @@ base_home="/home/justme/woodpecker/buildah-home/dev-image-build-noble-aot-v1-$co
 # 镜像标签不带 v（和正式版一致）：latest 和 <版本>；构建信息和清单里的 tag 带 v
 image_version="$MOSHIRO_VERSION"
 mkdir -p "$work" "$base_home"
+export REGISTRY_AUTH_FILE="$work/$component-auth.json"
+if [[ ! -s "$REGISTRY_AUTH_FILE" ]]; then
+  printf '{"auths":{}}\n' > "$REGISTRY_AUTH_FILE"
+  chmod 600 "$REGISTRY_AUTH_FILE"
+fi
 
 if [[ "$component" == backend ]]; then
   BUILDAH_HOME="$base_home" \
@@ -97,25 +102,48 @@ fi
 
 export HOME="$base_home"
 export BUILDAH_HOME="$base_home"
-export REGISTRY_AUTH_FILE="$work/$component-auth.json"
+source "$root/ci/buildah-env.sh"
+moshiro_setup_buildah "$base_home"
 context="$work/$component"
 local_image="localhost/moshiro-$component:dev-$arch-check"
 node_rid="linux-musl-x64"
 [[ "$arch" == arm64 ]] && node_rid="linux-musl-arm64"
-# Keep writable NuGet caches isolated per parallel build (component + arch).
-# Reuse still applies across pipeline runs without concurrent restore races.
-# Keep the package cache across Buildah storage generations so refreshing a
-# damaged layer store does not force another full NuGet download.
-nuget_cache="/home/justme/woodpecker/buildah-home/dev-image-build-$component-$arch/nuget-packages"
-mkdir -p "$nuget_cache"
+# Build a dedicated .NET 10 NativeAOT/AotAnywhere environment in this isolated
+# Buildah store. Keeping NuGet inside image layers avoids a shared writable
+# package mount being corrupted by canceled or parallel builds.
+builder_image="localhost/moshiro-dotnet10-nativeaot-aotanywhere:ci"
+source "$root/ci/nativeaot-toolchain.sh"
+moshiro_nativeaot_settings "$root"
+builder_cache="${MOSHIRO_RUNNER_IMAGE_CACHE:-/home/justme/woodpecker/cache/runner-image}"
+cached_key="$(cat "$builder_cache/nativeaot-builder.key" 2>/dev/null || true)"
+builder_id="$(cat "$builder_cache/nativeaot-builder.id" 2>/dev/null || true)"
+if [[ "$cached_key" == "$MOSHIRO_NATIVEAOT_BUILDER_KEY" && "$builder_id" =~ ^[0-9a-f]{64}$ && -f "$builder_cache/nativeaot-builder-$builder_id.oci" ]]; then
+  local_builder_id="$(buildah images --noheading --no-trunc --format '{{.ID}}' "$builder_image" 2>/dev/null || true)"
+  if [[ "${local_builder_id#sha256:}" != "$builder_id" ]]; then
+    run_bounded 10m buildah pull "oci-archive:$builder_cache/nativeaot-builder-$builder_id.oci"
+    buildah tag "$builder_id" "$builder_image"
+  fi
+  echo "using cached NativeAOT toolchain $builder_id"
+else
+  builder_context="$work/nativeaot-builder"
+  mkdir -p "$builder_context"
+  tr -d '\r' < "$root/global.json" > "$builder_context/global.json"
+  run_bounded 30m buildah bud --layers --network host --tls-verify=true --arch amd64 \
+    --build-arg "AOTANYWHERE_VERSION=$MOSHIRO_AOTANYWHERE_VERSION" \
+    --build-arg "ZIG_TOOLSET_VERSION=$MOSHIRO_ZIG_TOOLSET_VERSION" \
+    -f "$root/packaging/container/NativeAot.Builder.Containerfile" \
+    -t "$builder_image" "$builder_context"
+fi
 
 # A stable timestamp lets a retry of the same commit reuse the publish layer.
 commit_epoch="$(git -C "$root" show -s --format=%ct "$CI_COMMIT_SHA")"
 built_at="$(date -u -d "@$commit_epoch" +%Y-%m-%dT%H:%M:%SZ)"
 
 python3 "$root/ci/stage-node-image.py" "$component" "$node_rid" "$context"
-run_bounded 30m buildah bud --layers --network host --tls-verify=true --arch "$arch" \
-  --volume "$nuget_cache:/root/.nuget/packages:rw" \
+# Zig compiles musl libc by spawning many compiler processes. Buildah's default
+# nofile limit (1024) makes Zig fail with ProcessFdQuotaExceeded while linking.
+run_bounded 30m buildah bud --layers --network host --tls-verify=true --ulimit nofile=65536:65536 --arch "$arch" \
+  --build-arg "NATIVEAOT_BUILDER_IMAGE=$builder_image" \
   --build-arg "APP_VERSION=$image_version" \
   --build-arg "NODE_RID=$node_rid" \
   --build-arg "MOSHIRO_TAG=$MOSHIRO_TAG" --build-arg "MOSHIRO_COMMIT=${CI_COMMIT_SHA:0:10}" --build-arg "MOSHIRO_BUILT_AT=$built_at" \