fix(ci): pre-build .NET on host runner, remove SDK from Docker build

DinD overlay-on-overlay throttles dotnet child container to ~11s CPU/3h wall time.
Solution: dotnet restore+publish run on native runner FS (~10min), then
Dockerfile.runtime just COPYs the pre-built publish-output/ directory.
This brings build time from 3h+ (stuck) to ~10-15 minutes total.

.github/workflows/ha-build.yml

@@ -37,6 +37,34 @@ jobs:
           echo "image_repo=${REPO}" >> "$GITHUB_OUTPUT"
           echo "short_sha=${SHORT_SHA}"  >> "$GITHUB_OUTPUT"
 
+      - name: Install .NET SDK
+        # Build on the runner host filesystem (native I/O) to avoid DinD
+        # overlay-on-overlay throttling which makes dotnet publish ~20x slower.
+        run: |
+          DOTNET_INSTALL_DIR="$HOME/.dotnet"
+          mkdir -p "$DOTNET_INSTALL_DIR"
+          if ! "$DOTNET_INSTALL_DIR/dotnet" --version 2>/dev/null | grep -q "^10\\."; then
+            curl -fsSL https://dot.net/v1/dotnet-install.sh | bash /dev/stdin --channel 10.0 --install-dir "$DOTNET_INSTALL_DIR"
+          fi
+          echo "DOTNET_ROOT=$DOTNET_INSTALL_DIR" >> "$GITHUB_ENV"
+          echo "PATH=$DOTNET_INSTALL_DIR:$PATH" >> "$GITHUB_ENV"
+
+      - name: Restore NuGet packages
+        run: |
+          export PATH="$HOME/.dotnet:$PATH"
+          dotnet restore Jellyfin.Server/Jellyfin.Server.csproj --runtime linux-x64
+
+      - name: Publish Jellyfin server
+        run: |
+          export PATH="$HOME/.dotnet:$PATH"
+          dotnet publish Jellyfin.Server/Jellyfin.Server.csproj \
+            --configuration Release \
+            --runtime linux-x64 \
+            --self-contained false \
+            --no-restore \
+            -p:TreatWarningsAsErrors=false \
+            --output ./publish-output
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -44,7 +72,7 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
-          file: Dockerfile
+          file: Dockerfile.runtime
           platforms: linux/amd64
           push: true
           provenance: false