feat(build): add Docker-based reproducible build system

Adds docker/ with two Dockerfiles and a build.sh interactive script that
builds all three release targets (Windows exe, Linux binary, Android APK)
inside pinned Docker containers — no SDK required on the host.

Key design decisions:
- Source mounted read-only; build runs on an in-container copy so bin/obj
  never pollute the working tree.
- NuGet packages cached in a named Docker volume (plm-nuget-cache) across
  runs to avoid re-downloading on each build.
- Single-file desktop publishes use IncludeNativeLibrariesForSelfExtract so
  Avalonia's native libs (Skia, HarfBuzz, ANGLE) are embedded — without this
  flag the exe/binary silently fails to start.
- Android Dockerfile pins platform API 36 (dictated by the .NET 10 android
  workload, error XA5207 if mismatched) and bakes the full Android SDK +
  workload into the image layer.
- Artifacts are chown'd back to the host user so dist/ files are never
  owned by root.

All three targets verified end-to-end from a clean docker system prune -a:
Windows PE32+ exe (103 MB), Linux single-file binary launches on this host,
Android APK installs and renders UI on API-34 x86_64 emulator.

docker/Dockerfile.desktop

@@ -0,0 +1,11 @@
+FROM mcr.microsoft.com/dotnet/sdk:10.0
+
+# clang and zlib are required by the .NET SDK for native compilation steps
+# that occur even during managed cross-publish (win-x64 / linux-x64).
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        clang \
+        zlib1g-dev \
+        libkrb5-dev \
+    && apt-get clean && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /tmp/build