ci: isolate caches and trust ARM Alpine keys [CI] [SKIP TESTS]

Signed-off-by: JustMe <mr.toing@outlook.com>

packaging/container/Probe.NativeBuild.Containerfile

@@ -1,22 +1,32 @@
 # Run all build commands on the native amd64 runner. AotAnywhere cross-links
 # the NativeAOT output, so an ARM64 build never needs QEMU.
+FROM --platform=linux/arm64 alpine:3.24 AS arm64-apk-keys
+
 FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/sdk:10.0-alpine-aot AS build
 
 WORKDIR /src/backend
 COPY restore/backend/ ./
 ARG NODE_RID=linux-musl-x64
 ENV NUGET_PACKAGES=/root/.nuget/packages
+COPY --from=arm64-apk-keys /usr/share/apk/keys/aarch64 /tmp/apk-keys-arm64
 # restore 也要带 PublishAot：不然不会还原 ILCompiler，之后 --no-restore 的发布就悄悄变成「裁剪过的框架依赖程序」
 RUN dotnet restore probe/src/MoShiro.Probe -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true --artifacts-path /artifacts \
     && dotnet restore fleet/tools/fleet-enroll -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true --artifacts-path /artifacts
 
 # Fetch target-musl runtime libraries on the native builder before copying
 # application sources. This layer stays reusable when only app code changes.
-RUN apk_arch=x86_64; \
+RUN set -eu; \
+    apk_arch=x86_64; \
     case "$NODE_RID" in *arm64) apk_arch=aarch64 ;; esac; \
     mkdir -p /tmp/runtime-apks /tmp/runtime-root /out/runtime; \
-    apk --arch "$apk_arch" fetch --recursive --output /tmp/runtime-apks libmsquic numactl lttng-ust zlib; \
-    for package in /tmp/runtime-apks/*.apk; do tar -xzf "$package" -C /tmp/runtime-root; done; \
+    if [ "$apk_arch" = aarch64 ]; then \
+      apk --keys-dir /tmp/apk-keys-arm64 --arch "$apk_arch" fetch --recursive --output /tmp/runtime-apks libmsquic numactl lttng-ust zlib; \
+    else \
+      apk --arch "$apk_arch" fetch --recursive --output /tmp/runtime-apks libmsquic numactl lttng-ust zlib; \
+    fi; \
+    set -- /tmp/runtime-apks/*.apk; \
+    [ -f "$1" ]; \
+    for package do tar -xzf "$package" -C /tmp/runtime-root; done; \
     cp -a /tmp/runtime-root/usr/lib/*.so* /out/runtime/
 
 COPY source/backend/ ./