CI: build amd64-only via buildx with provenance/sbom off

Forgejo runner with default Docker emits OCI image-index manifests for
multi-arch + attestation builds. argocd-image-updater cannot follow the
index → manifest chain to read the Created timestamp, so it never sees
new tags. Pinning to a single linux/amd64 build with no provenance/sbom
produces a plain Docker v2 manifest that image-updater can read.

.forgejo/workflows/build.yaml

@@ -37,10 +37,17 @@ jobs:
       - name: Log in to container registry
         run: echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login ${{ secrets.REGISTRY_URL }} -u ${{ secrets.REGISTRY_USER }} --password-stdin
 
+      - name: Set up Docker Buildx
+        uses: https://github.com/docker/setup-buildx-action@v3
+
       - name: Build and push Docker image
-        run: |
-          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
-          TAG="${{ steps.tag.outputs.tag }}"
-          docker build -t "${IMAGE}:${TAG}" -t "${IMAGE}:main" .
-          docker push "${IMAGE}:${TAG}"
-          docker push "${IMAGE}:main"
+        uses: https://github.com/docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          platforms: linux/amd64
+          provenance: false
+          sbom: false
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.tag }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:main