ci: install docker CLI from static tarball, not apt

The runner image's bookworm apt repos have been failing GPG
verification with "At least one invalid signature was encountered"
on every job. Clearing lists and reinstalling debian-archive-keyring
on the host doesn't help because the runner spins up a fresh
container per job. Dodge apt entirely by grabbing the static Docker
27.5.1 client binary from download.docker.com. The binary talks to
the host's /var/run/docker.sock that act_runner mounts into the job
container, which is all we need for build + push.

.forgejo/workflows/build.yaml

@@ -24,7 +24,17 @@ jobs:
 
       - name: Install Docker CLI
         run: |
-          apt-get update && apt-get install -y docker.io
+          # Dodge apt entirely — the runner image's bookworm repos have been
+          # failing GPG verification with "At least one invalid signature".
+          # The static Docker client binary talks to the host's daemon socket
+          # that act_runner mounts into the job container, which is all we
+          # need for `docker build` / `docker push`.
+          curl -fsSL -o /tmp/docker.tgz \
+            https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz
+          tar xzf /tmp/docker.tgz -C /tmp
+          install -m 0755 /tmp/docker/docker /usr/local/bin/docker
+          rm -rf /tmp/docker /tmp/docker.tgz
+          docker --version
 
       - name: Generate image tag
         id: tag