dotnet/sdk:10.0-alpine regression (sha256:620e765f...) — dotnet nuget/dotnet restore fail with EPERM on temp-file writes/renames anywhere in the container

### Describe the bug

### Description
Between two floating-tag pulls of `mcr.microsoft.com/dotnet/sdk:10.0-alpine` roughly a week
apart, the image content changed in a way that breaks `dotnet nuget add source` and
`dotnet restore` inside our Docker builds. Every temp-file write/atomic-rename the SDK/NuGet
client performs fails with "Operation not permitted" (EPERM), regardless of directory.

- Last known-good digest: sha256:d8ee39817ca03a3757288e83c37ed73cc969a286c603b827c7cbe33add1c2d1c
- First known-bad digest: sha256:620e765fe18186c08399f7aa978f79f04b6bbf0ee1b3b8a91e2d5c9619e59da1

### Repro
```dockerfile
FROM mcr.microsoft.com/dotnet/sdk:10.0-alpine
RUN dotnet nuget add source "https://example.com/nuget/" --name test \
--username u --password p --store-password-in-clear-text

Fails immediately:
error: Failed to read NuGet.Config due to unauthorized access. Path: '/root/.nuget/NuGet/NuGet.Config'.
error: Access to the path '/root/.nuget/NuGet/NuGet.Config' is denied.
error: Operation not permitted

### Which .NET image(s) are you using?

mcr.microsoft.com/dotnet/sdk@sha256:620e765fe18186c08399f7aa978f79f04b6bbf0ee1b3b8a91e2d5c9619e59da1

### Steps to reproduce

### Steps to reproduce

**1. Minimal Dockerfile:**
```dockerfile
FROM mcr.microsoft.com/dotnet/sdk@sha256:620e765fe18186c08399f7aa978f79f04b6bbf0ee1b3b8a91e2d5c9619e59da1
RUN dotnet nuget add source "https://api.nuget.org/v3/index.json" --name test \
--username u --password p --store-password-in-clear-text

build it:
docker build -t repro .

Result:
error: Failed to read NuGet.Config due to unauthorized access. Path: '/root/.nuget/NuGet/NuGet.Config'.
error: Access to the path '/root/.nuget/NuGet/NuGet.Config' is denied.
error: Operation not permitted

Confirm the fix — swap the digest to
sha256:d8ee39817ca03a3757288e83c37ed73cc969a286c603b827c7cbe33add1c2d1c in any of the above
and it works cleanly with zero other changes.

Expected behavior
dotnet nuget add source / dotnet restore work as they did on the previous image digest.

### Other information

_No response_

### Output of `docker version`

```console
Version info
Image: mcr.microsoft.com/dotnet/sdk:10.0-alpine
SDK reported inside container: 10.0.400
Alpine base (musl libc)
```

### Output of `docker info`

```console

```

Start with the minimal Dockerfile reproduction using the first known-bad digest, then compare its image layers and metadata with the last known-good digest. Investigate the container image build entry points; done means dotnet nuget add source and dotnet restore complete without EPERM on the bad or corrected image.

Written by the indexing model from the issue text.