ci: persist the prepared NativeAOT toolchain archive [CI]

ci/restore-linux-dependencies.sh

@@ -63,6 +63,7 @@ if [[ "$mode" == dev || "$mode" == agent ]]; then
   moshiro_nativeaot_settings "$root"
   builder_image="localhost/moshiro-dotnet10-nativeaot-aotanywhere:ci"
   builder_cache="${MOSHIRO_RUNNER_IMAGE_CACHE:-/home/justme/woodpecker/cache/runner-image}"
+  mkdir -p "$builder_cache"
   cached_key="$(cat "$builder_cache/nativeaot-builder.key" 2>/dev/null || true)"
   cached_id="$(cat "$builder_cache/nativeaot-builder.id" 2>/dev/null || true)"
   local_key="$(cat "$base_home/nativeaot-builder.key" 2>/dev/null || true)"
@@ -89,6 +90,34 @@ if [[ "$mode" == dev || "$mode" == agent ]]; then
   fi
   builder_image="$(buildah images --noheading --no-trunc --format '{{.ID}}' "$builder_image")"
   printf '%s\n' "$MOSHIRO_NATIVEAOT_BUILDER_KEY" > "$base_home/nativeaot-builder.key"
+  builder_id="${builder_image#sha256:}"
+  archive="$builder_cache/nativeaot-builder-$builder_id.oci"
+  exec 6> "$builder_cache/.lock"
+  flock -w 900 6 || { echo 'could not lock the runner toolchain cache' >&2; exit 1; }
+  if [[ ! -s "$archive" ]]; then
+    archive_tmp="$archive.tmp"
+    rm -f "$archive_tmp"
+    python3 "$root/ci/run-with-timeout.py" 900 buildah push --format oci "$builder_image" "oci-archive:$archive_tmp"
+    mv "$archive_tmp" "$archive"
+  fi
+  printf '%s\n' "$builder_id" > "$builder_cache/nativeaot-builder.id.tmp.$$"
+  mv -f "$builder_cache/nativeaot-builder.id.tmp.$$" "$builder_cache/nativeaot-builder.id"
+  printf '%s\n' "$MOSHIRO_NATIVEAOT_BUILDER_KEY" > "$builder_cache/nativeaot-builder.key.tmp.$$"
+  mv -f "$builder_cache/nativeaot-builder.key.tmp.$$" "$builder_cache/nativeaot-builder.key"
+  python3 - "$builder_cache" "$archive" <<'PY'
+from pathlib import Path
+import sys
+cache, active = Path(sys.argv[1]), Path(sys.argv[2])
+archives = sorted(cache.glob('nativeaot-builder-*.oci'), key=lambda path: path.stat().st_mtime, reverse=True)
+previous = next((path for path in archives if path != active), None)
+for path in archives:
+    if path not in {active, previous}:
+        path.unlink()
+for path in cache.glob('nativeaot-builder-*.oci.tmp'):
+    path.unlink()
+PY
+  flock -u 6
+  exec 6>&-
 
   agent_rids=(linux-musl-arm64 linux-x64 linux-arm64)
   for rid in "${agent_rids[@]}"; do