Revert to self-contained dind, drop buildx

The runner-side docker CLI/DOCKER_HOST config described by the host
admin doesn't appear to be live yet (default label still has no
docker CLI; a custom container never saw DOCKER_HOST injected). Go
back to a fully self-contained job: own dind sidecar + explicit
DOCKER_HOST, plain docker build/push instead of buildx (which reads
its endpoint from the docker context file rather than DOCKER_HOST).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.forgejo/workflows/build.yml

@@ -7,14 +7,35 @@ on:
 
 jobs:
   build-and-push:
-    # Use the runner's default job image as-is: it's pre-configured with
-    # DOCKER_HOST pointing at the runner's dind sidecar (and privileged
-    # access). Overriding `container:` here loses that configuration.
     runs-on: docker
+    # Self-contained: don't depend on the runner injecting a docker CLI or
+    # DOCKER_HOST into the default job image (observed not to be the case
+    # in practice). actions/checkout needs Node, so use a node image and
+    # install the docker CLI, talking to our own dind sidecar. Plain
+    # `docker` commands (not buildx) so DOCKER_HOST is honored directly.
+    container: node:20-bookworm
+    services:
+      docker:
+        image: docker:27-dind
+        options: --privileged
+    env:
+      DOCKER_HOST: tcp://docker:2375
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Install Docker CLI
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends ca-certificates curl
+          install -m 0755 -d /etc/apt/keyrings
+          curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
+          chmod a+r /etc/apt/keyrings/docker.asc
+          echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo $VERSION_CODENAME) stable" \
+            > /etc/apt/sources.list.d/docker.list
+          apt-get update
+          apt-get install -y --no-install-recommends docker-ce-cli
+
       - name: Log in to Forgejo registry
         run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login git.rosenvold.tech -u "${{ github.actor }}" --password-stdin