ci: move MongoDB and Iceberg E2E builds to a Docker-based shared builder

[iamlinjunhong]

Background

MongoDB E2E and Iceberg E2E are repeatedly reaching their 45-minute GitHub Actions timeout while the host runner is still resolving the MatrixOne Go package graph.

Representative failures:

• MongoDB E2E Local: https://github.com/matrixorigin/matrixone/actions/runs/31655374716/job/94308554890
• Iceberg E2E Local: https://github.com/matrixorigin/matrixone/actions/runs/31668714772/job/94348798148

Both jobs stop inside make build at Verify Go package graph, with Go modules downloading slowly. Neither job reaches the connector service startup phase, so this is not a MongoDB, Nessie, or MinIO container startup failure.

The contrast is visible in these two jobs from the same CI run:

• Docker Compose path succeeds: https://github.com/matrixorigin/matrixone/actions/runs/31663214904/job/94332374052
• Host standalone build remains in Go module download until its 75-minute timeout: https://github.com/matrixorigin/matrixone/actions/runs/31663214904/job/94332374099

In the successful Compose job, the Docker module-download step completes in about 23 seconds and the MO build in about 181 seconds.

Current behavior

MongoDB E2E currently:

1. Builds MatrixOne on the host.
2. Starts MongoDB with Docker Compose.
3. Runs mo-service and the Go E2E helper on the host.

Iceberg E2E currently:

1. Builds MatrixOne on the host.
2. Builds/tests the nested iceberggo adapter module on the host.
3. Starts Nessie and MinIO with Docker Compose.
4. Runs mo-service and the Go E2E helper on the host.

The external services are already containerized. The unreliable part is the cold host-side MO/test build.

Proposed direction

• Build the current PR source with a nightly-warmed Docker CI builder instead of relying on the host Go module cache.
• Produce a self-contained runtime artifact containing mo-service, runtime libraries, dictionaries, and build identity metadata.
• Share the MO build artifact between MongoDB and Iceberg consumers when they run under the same parent workflow.
• Do not rebuild MatrixOne inside each connector script after the artifact is downloaded.
• Build the MongoDB E2E helper in the builder environment so a later host-side go run does not repeat dependency downloads.
• Warm and test the nested pkg/iceberg/adapter/iceberggo module in the Iceberg builder/test environment.
• Keep MongoDB, Nessie, and MinIO in Compose; optionally run MO and the test helper in the same Compose network for a fully reproducible runtime.
• Pin service images by version or digest, including replacing the current Nessie latest tag.
• Reuse the shared-builder and artifact contract from ci: wire shared build and nightly builder image into PR CI #27077 and ci: shared per-run build + nightly-warmed builder image for PR CI CI#418 after that contract is ready, rather than creating a connector-specific cache format.
• Preserve the current MongoDB blocking behavior and Iceberg advisory behavior.

Acceptance criteria

• MongoDB E2E and Iceberg E2E reach their actual connector tests with an empty host Go module/build cache.
• The tested mo-service is built from the exact PR head, verified through artifact build metadata.
• MongoDB E2E does not invoke a host-side full make build or uncached go run.
• Iceberg E2E does not depend on uncached host downloads for either the main module or the iceberggo nested module.
• Runtime artifact loader smoke test passes without relying on runner-specific LD_LIBRARY_PATH state.
• A changed thirdparties tree invalidates prebuilt native outputs and rebuilds them.
• Builder-image pull/cache failure produces a bounded, explicit fallback or infrastructure error instead of consuming the full job timeout.
• Compose teardown and sanitized diagnostic artifact upload still run on failure.
• MongoDB and Iceberg E2E pass on a representative connector PR.