[BUG] Darling Linux build fails repo-wide: the floating sdk:10.0 image rolled to 10.0.400 past global.json's pin #2200

Component

Build / CI

Describe the Bug

The Darling Linux build job started failing repo-wide at roughly 18:30 UTC on 2026-08-11, before compiling a single line:

Requested SDK version: 10.0.302
global.json file: /src/global.json

Installed SDKs:

Install the [10.0.302] .NET SDK or update [/src/global.json] to match an installed SDK.
10.0.400 [/usr/share/dotnet/sdk]

Darling/Dockerfile:16 uses the floating tag mcr.microsoft.com/dotnet/sdk:10.0. That tag has just rolled forward to SDK 10.0.400. global.json pins 10.0.302 with rollForward: latestPatch, which accepts the 10.0.3xx feature band only - so 10.0.400 is correctly refused, and the publish dies with exit code 155.

Nothing in the repo changed. The break arrived from outside, on a floating tag.

Evidence it is not any one branch's change

• dev's Build run at 18:22 UTC (8f1c5248) passed; the next run at 18:38 failed.
• On PR Decode the loader status instead of printing a raw Win32 number (#2186) #2194, sha 9a60f423 passed this exact job, and sha c1e75ebf - which changes only CHANGELOG.md on top of it plus a merge of dev - failed. Neither global.json nor Darling/Dockerfile differs between those two shas.
• Re-running the failed job reproduces it exactly, so it is not a flake or a cache miss.
• Within the same run, build (Windows, full test suites) and Darling PostgreSQL tests both pass. Only the container publish fails.

Expected Behavior

The Linux image build resolves an SDK that satisfies global.json.

Suggested Fix

Pin the Dockerfile's SDK tag to the band global.json names, e.g. mcr.microsoft.com/dotnet/sdk:10.0.302 (or whatever exact tag is current within 10.0.3xx). #1758 was explicitly "Pin the SDK band three ways instead of agreeing by float" - the Dockerfile is the one place still agreeing by float, which is why it is the one place that broke. Advancing global.json to 10.0.400 instead would work, but it moves the required SDK for every developer box and CI runner to fix a container-only problem, so it is the bigger change of the two.

The runtime stage (mcr.microsoft.com/dotnet/aspnet:10.0, line 22) floats too. It did not break here - it has no global.json to satisfy - but it is the same class of exposure.

Impact

Blocks the required checks on every open PR and on dev, independent of what the PR changes.