build: run build.fsx with dotnet fsi instead of the FAKE runner

[fpellet]

First step towards #4348.

The build is started through mono packages/build/FAKE/tools/FAKE.exe, a .NET Framework
executable. That runner is what forces Mono on Linux, pulls in the legacy MSBuild discovery and
the obsolete RoslynTools.MSBuild path behind #4002, and has to stay in step with the .NET SDK.

The problem is the runner, not the library. So this PR only changes how the script is started:
build.fsx stays the same FAKE 4.64.17 script, but runs under dotnet fsi.

Upgrading to FAKE 6 is deliberately left for later: it would mean rewriting the ~730 lines of the
script (every API is renamed), replacing Octokit.fsx with Fake.Api.GitHub and moving the GitHub
release to a token. None of that is needed to drop the runner.

Changes

• build.sh / build.cmd call dotnet fsi build.fsx. The Mono-specific certmgr / mozroots
  diagnostics block goes away, as does the RoslynTools.MSBuild line (that package is not even in
  paket.dependencies any more).
• build.fsx gains ~10 lines: without the runner the script has to parse its own command line, so
  it translates <Target> key=value ... into the environment variables FAKE reads back through
  getBuildParam / hasBuildParam. It runs before any other binding, because top-level values such
  as testSuiteFilterFlakyTests read build parameters while the script loads.
• build.fsx drops the ServicePointManager.SecurityProtocol assignment. It enabled TLS 1.2 on old
  runtimes and now throws NotSupportedException on .NET 10, since it also requests SSL3.
• Documentation updated. CLAUDE.md's skip examples are corrected on the way: skip switches are
  build parameters, not targets, so they take a value and follow the target name — the documented
  build.cmd SkipTests was read as a target name and never worked.

No change to paket.dependencies / paket.lock, to the targets, to the produced artifacts, to the
target frameworks, or to ci.yml.

What this does not do

Mono is still installed and still required, for the targets that execute .NET Framework binaries:
MergePaketTool (which runs ILRepack.exe) and the net461 test passes. FAKE keeps prefixing those
with mono on its own, so they needed no change. Removing that is the next step.

Validation

Run on Linux, .NET SDK 10.0.400:

• dotnet fsi build.fsx CleanDocs — target selection works, only that target runs.
• dotnet fsi build.fsx Build — OK.
• dotnet fsi build.fsx Publish — OK, produces bin/net461/paket.exe, bin/net10.0/paket.dll,
  bin_bootstrapper/net461/paket.bootstrapper.exe, bin_bootstrapper/net10.0/paket.bootstrapper.dll.
• dotnet fsi build.fsx MergePaketTool — OK, including RunTests through the target graph.
  bin/merged/paket.exe is produced and runs: Paket version 11.0.0-alpha001.

Worth a look on Windows CI, since build.cmd under dotnet fsi could not be exercised locally.

Also checked while porting: FakeLib.dll (which targets .NETFramework,Version=v4.5) loads fine
under .NET 10, as do #load of Octokit.fsx and the #r of the GAC assemblies at the top of the
script; isMono still evaluates to true on Linux, so the not isMono guards keep the exact same
"not Windows" meaning as before.

Follow-ups for #4348

1. Replace ILRepack.exe with the dotnet-ilrepack tool and restrict the net461 test passes to
   Windows — only then can Install Mono leave ci.yml.
2. Move FAKE 4 to FAKE 6 as a library. Note for whoever does it: DotNet.test defaults to
   Configuration = Debug in FAKE 6 while build/publish/pack default to Release, so with
   --no-build the tests would look in bin/Debug.
3. Documentation generation still runs on FAKE 4 and FSharp.Formatting 3 (the package only ships
   lib/net40), which is why FAKE < 5 stays in the Build group.