ci: cap buildkit max-parallelism at 1 to avoid OOM on 4GB builder

Multi-platform buildx (linux/amd64 + linux/arm64) races both platforms in
parallel by default. On the 4GB build agent, QEMU-emulated 'dotnet restore'
for arm64 alone spikes to 2-3GB and racing amd64 apt-installs push us into
the OOM Killer ("cannot allocate memory" at build 4/5).

Fix: write a small buildkitd.toml with max-parallelism = 1 and pass it to
'docker buildx create --config'. buildkit now runs stages sequentially so
the two platforms don't step on each other's RSS.

Recreate the builder every run so the config always takes effect.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Jenkinsfile

@@ -72,7 +72,18 @@ pipeline {
                     # Verify emulation works before proceeding
                     sudo docker run --rm --platform linux/arm64 docker.m.daocloud.io/library/alpine:latest uname -m
 
-                    if ! sudo docker buildx inspect --builder ${BUILDER_NAME} >/dev/null 2>&1; then
+                    # buildkitd config: cap parallelism at 1 so multi-platform builds run
+                    # sequentially instead of racing for RAM on this ~4GB builder. QEMU-emulated
+                    # dotnet restore alone can spike to 2-3GB, and OOM Killer will otherwise
+                    # take out one of the platforms mid-restore.
+                    BUILDKITD_TOML=/tmp/buildkitd-${BUILDER_NAME}.toml
+                    cat > \$BUILDKITD_TOML <<'EOF'
+[worker.oci]
+  max-parallelism = 1
+EOF
+
+                    # Recreate the builder to make sure the config takes effect (idempotent).
+                    sudo docker buildx rm ${BUILDER_NAME} >/dev/null 2>&1 || true
                     sudo docker buildx create \
                       --name ${BUILDER_NAME} \
                       --driver docker-container \
@@ -83,8 +94,8 @@ pipeline {
                       --driver-opt 'env.http_proxy=${HTTP_PROXY_URL}' \
                       --driver-opt 'env.https_proxy=${HTTP_PROXY_URL}' \
                       --driver-opt 'env.no_proxy=reg.nxsir.cn' \
+                      --config \$BUILDKITD_TOML \
                       --use
-                    fi
                     sudo docker buildx inspect --builder ${BUILDER_NAME} --bootstrap >/dev/null
                 """
             }