ci: read the built binaries from an OCI archive instead of mounting the image [CI]

buildah unshare fails on the CI host with memfd_create: Invalid argument, so extract-node-binaries.sh failed right after a successful native build. Exporting an OCI archive needs no mount (the toolchain archive already works that way); extract-oci-files.py reads the files from the layers, later layers win and whiteouts delete.

ci/extract-node-binaries.sh

@@ -1,13 +1,11 @@
 #!/usr/bin/env bash
-# Keep mount, reads and unmount inside the same rootless user/mount namespace.
+# 从构建出的镜像里取出 moshiro-agent 和 fleet-enroll，不挂载镜像：
+# buildah unshare / mount 在 CI 主机上报 memfd_create: Invalid argument，而导出 OCI 归档不需要挂载（工具链归档也是这样做的）。
 set -euo pipefail
 image="${1:?usage: extract-node-binaries.sh <image> <destination>}"
 destination="${2:?}"
-mkdir -p "$destination"
-buildah unshare bash -s -- "$image" "$destination" <<'SH'
-set -euo pipefail
-container="$(buildah from "$1")"
-trap 'buildah unmount "$container" >/dev/null 2>&1 || true; buildah rm "$container" >/dev/null' EXIT
-mount="$(buildah mount "$container")"
-install -m 0755 "$mount/out/agent/moshiro-agent" "$mount/out/enroll/fleet-enroll" "$2/"
-SH
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+work="$(mktemp -d)"
+trap 'rm -rf "$work"' EXIT
+buildah push --format oci "$image" "oci-archive:$work/image.tar"
+python3 "$root/ci/extract-oci-files.py" "$work/image.tar" "$destination" out/agent/moshiro-agent out/enroll/fleet-enroll