Fix pipeline: run build job in a container with docker CLI

The runner's default job image has no docker binary. Run the job in
docker:27-cli with a docker:27-dind sidecar service instead of relying
on the runner exposing a host docker socket.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.forgejo/workflows/build.yml

@@ -7,10 +7,17 @@ on:
 
 jobs:
   build-and-push:
-    # Needs docker-in-docker: the runner's job container must have access to
-    # a docker socket (e.g. act_runner configured with
-    # -v /var/run/docker.sock:/var/run/docker.sock) for buildx to work.
     runs-on: docker
+    # The default job image has no docker CLI, so run in an image that has
+    # one and talk to a sidecar dind daemon over the network instead of
+    # relying on the runner exposing a host docker socket.
+    container: docker:27-cli
+    services:
+      docker:
+        image: docker:27-dind
+        options: --privileged
+    env:
+      DOCKER_HOST: tcp://docker:2375
     steps:
       - name: Checkout
         uses: actions/checkout@v4