Fix pipeline: use node image with docker CLI installed

JS actions (checkout, login-action, etc.) need Node.js, so the docker
CLI-only alpine image couldn't run them. Switch to node:20-bookworm and
install the docker CLI/buildx plugin as a step instead.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.forgejo/workflows/build.yml

@@ -8,10 +8,11 @@ on:
 jobs:
   build-and-push:
     runs-on: docker
-    # The default job image has no docker CLI, so run in an image that has
-    # one and talk to a sidecar dind daemon over the network instead of
-    # relying on the runner exposing a host docker socket.
-    container: docker:27-cli
+    # actions/checkout & co. are JS actions and need Node, so the job
+    # container has to be a Node image (not a bare docker CLI image). We
+    # install the Docker CLI into it and talk to a sidecar dind daemon over
+    # the network instead of relying on the runner exposing a host socket.
+    container: node:20-bookworm
     services:
       docker:
         image: docker:27-dind
@@ -22,6 +23,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Install Docker CLI
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends ca-certificates curl
+          install -m 0755 -d /etc/apt/keyrings
+          curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
+          chmod a+r /etc/apt/keyrings/docker.asc
+          echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo $VERSION_CODENAME) stable" \
+            > /etc/apt/sources.list.d/docker.list
+          apt-get update
+          apt-get install -y --no-install-recommends docker-ce-cli docker-buildx-plugin
+
       - name: Log in to Forgejo registry
         uses: docker/login-action@v3
         with: