fix(build): NuGet cache mount sharing=locked to avoid concurrent restore races

With capacity=2 in the runner, two builds can run in parallel and share
the same buildkit cache mount (sharing=shared is the default). dotnet
restore writes NuGet temp files (*.ar5 etc.) that the OTHER build can
race-remove mid-extraction, yielding 'Could not find file' errors like:

  error : Could not find file '/root/.nuget/packages/microsoft.identitymodel.abstractions/8.0.1/3wu4hkqc.ar5'

sharing=locked serializes cache access (one build at a time can touch
the mount). Still benefits from across-build caching, just no concurrency
on the mount itself.

Dockerfile

@@ -6,12 +6,12 @@ WORKDIR /src
 
 # 先复制 csproj，单独 restore（利用层缓存）
 COPY gitea-mcp.csproj .
-RUN --mount=type=cache,target=/root/.nuget/packages \
+RUN --mount=type=cache,target=/root/.nuget/packages,sharing=locked \
     dotnet restore gitea-mcp.csproj
 
 # 复制剩余源码并发布
 COPY . .
-RUN --mount=type=cache,target=/root/.nuget/packages \
+RUN --mount=type=cache,target=/root/.nuget/packages,sharing=locked \
     dotnet publish gitea-mcp.csproj \
     -c Release \
     -o /app/publish \