Give each transient MSBuild Server its own identity

[JanProvaznik]

Stacked on #14584 (sidecar TaskHost ownership); review that first. The diff below is this commit only.

The bug

dotnet build -mt -nodeReuse:false kills a resident MSBuild Server.

resident after  -mt -nodeReuse:true   : 32752
server(s) after -mt -nodeReuse:false  : (none)

A -mt build with node reuse off still needs a server (for Server GC), but must not leave one behind, so XMake.cs:491 sets shutdownServerAfterBuild and the client tells its server to exit once the build finishes. The comment there calls this "a short-lived server: fresh process, torn down afterward".

The process was never fresh. MSBuildClient.GetHandshake() and OutOfProcServerNode.Run both call GetHandshakeOptions(taskHost: false, TaskHostParameters.Empty, architectureFlagToSet: …), where nodeReuse defaults to false, so resident and transient servers hashed to identical pipe and mutex names. The transient client therefore connected to the resident server and ordered that to shut down.

Why the omission was originally safe, at XMake.cs:464:

bool nodeReuseDisqualifies = !nodeReuse && !multiThreaded;

Drop the -mt clause — the recent addition — and it reads !nodeReuse: node reuse being off disqualified the server entirely. Node reuse was a precondition for a server existing, never a dimension of its identity. -mt introduced a second class of server without giving it one.

The fix

A transient server carries a per-invocation instance id, generated by the client and passed to the server it launches. Resident servers pass no id and their endpoint is byte-for-byte unchanged.

The id feeds ComputeHash(), and therefore the pipe and all three mutex names, but deliberately not RetrieveHandshakeComponents(). The handshake still answers "are we compatible"; the hash answers "which server am I talking to". Keeping those separate means no wire-format change.

Passing the id on the child's command line follows the existing pattern for launch-time node parameters (/nodemode, /nodereuse, /low, /parentpacketversion).

Why not just add the NodeReuse bit to the handshake

That is the smaller change and it does fix the reported bug, but it gives all transient builds one shared identity — and every name they need comes from that one hash: the pipe, msbuild-server-running-*, msbuild-server-busy-* and msbuild-server-launch-*. Transient servers then cannot coexist:

• a second concurrent transient client sees the running mutex held, skips launching, finds the server busy, and silently falls back to an in-process build, losing the server -mt asked for;
• if it launched anyway, OutOfProcServerNode refuses to start with "MSBuild server is already running!";
• and in the window after the first build finishes but before its server exits, a second client can connect to a server that is already shutting down — the same bug at smaller scale.

Per-invocation ids let N concurrent transient builds run N private servers.

Also fixed: the over-provisioning guard

HandleServerShutdownCommand self-terminates when CountActiveNodesWithMode(NodeMode.OutOfProcServerNode) > 1. The comment claims "per handshake", but the implementation filters only on process name and /nodemode:, so it counts every server process machine-wide. It is unreachable today (it needs a NodeBuildComplete(PrepareForReuse: true), and the only sender sends false), but allowing several servers at once would arm it and let a resident server terminate itself on seeing transients. The count now excludes transient servers, which never compete for the resident role.

Behaviour changes

1. More than one server process can be alive at once — one resident plus one per concurrent transient build. A CI agent running builds in parallel will hold more server processes than before. Each still exits with its build.
2. dotnet build-server shutdown cannot reach a transient server, by design — it is private to one build. That is only safe because a transient is self-limiting, so all three exits were checked: it exits after its build; if its client dies once connected the pipe breaks and OnLinkStatusChanged sets ConnectionFailed; and if its client dies before connecting, NodeEndpointOutOfProcBase.PacketPumpProc gives up after NodeConnectionTimeout (default 15 minutes). An orphan is bounded, not permanent.
3. Resident server behaviour, naming and reuse are unchanged.

Verification

End-to-end, on a bootstrapped build:

	resident survives	transient gets own server
before	no — killed	n/a
after	yes	yes

Concurrency, sampled while three -mt -nodeReuse:false builds overlap:

max concurrent servers  : 3
distinct server PIDs    : 5272, 7544, 43416  (count=3)
servers after           : (none)

Tests added:

• TransientBuildDoesNotShutDownResidentServer — the regression.
• ConcurrentTransientBuildsEachGetTheirOwnServer — the invariant this design exists for and the one the NodeReuse-bit approach fails. It checks each build ran in a server distinct from its own client first, because contention shows up as an in-process fallback rather than as equal PIDs.
• TransientBuildDoesNotAdoptResidentSidecars — cross-check against Own sidecar TaskHosts so they cannot outlive their owner #14584: a transient build must bring its own TaskHost rather than adopt one owned by a server that outlives it.
• Five handshake tests pinning that the resident hash is unaffected by an absent id, that ids separate servers from each other and from the resident, that the same id is stable across processes, that GetKey() (the wire handshake) is unaffected, and that pipe and both mutex names differ.

All three E2E tests were confirmed to fail with only the id generation disabled and pass with it, so they genuinely cover the bug.

*Server* suite locally: 19 failures before this change and 19 after, with 3 more passing tests — no regressions. (Those 19 are a pre-existing local-harness limitation: MSBuild Server does not start under ExecMSBuild on this machine, and they fail identically on clean main. The new tests use the bootstrap, which does start a server.)

Not in this PR

Worker-node ownership, the remaining item in this series.

One test was narrowed after the first CI run

An earlier version asserted the resident server's sidecar was still alive after a transient build. It failed on all three Windows legs while passing on Linux, macOS and locally (3/3). Three targeted experiments each falsified a plausible cause: the end-of-build machine-wide scan cannot reach a TaskHost at all because it probes with the worker handshake; a foreign -nodeReuse:false build does not reap an owned sidecar; and neither does a second tenant with a different handshake salt requesting its own sidecar.

A sidecar lives exactly as long as its owner, so its survival belongs to TransientBuildDoesNotShutDownResidentServer and to #14584 rather than to this change — and asserting it here additionally requires that nothing else on the machine touches that process for the duration of a second build, which does not hold when the suite runs in parallel. The test now asserts the deterministic property this change owns: a transient build brings its own server and its own TaskHost. It still fails without the fix.