ci: install buildx and use docker buildx build --push

The Dockerfile uses `--mount=type=cache` which requires BuildKit.
The static docker tarball only ships the CLI, so the plugin has to
be installed separately. Also flip the build step to
`docker buildx build --push` so build and push happen in one pass
instead of two (avoids the intermediate local-daemon load).

.forgejo/workflows/build.yaml

@@ -22,19 +22,27 @@ jobs:
       - name: Checkout code
         uses: https://github.com/actions/checkout@v4
 
-      - name: Install Docker CLI
+      - name: Install Docker CLI and buildx
         run: |
           # Dodge apt entirely — the runner image's bookworm repos have been
           # failing GPG verification with "At least one invalid signature".
           # The static Docker client binary talks to the host's daemon socket
-          # that act_runner mounts into the job container, which is all we
-          # need for `docker build` / `docker push`.
+          # that act_runner mounts into the job container. buildx is needed
+          # separately because the Dockerfile uses `--mount=type=cache`,
+          # which is a BuildKit-only feature.
           curl -fsSL -o /tmp/docker.tgz \
             https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz
           tar xzf /tmp/docker.tgz -C /tmp
           install -m 0755 /tmp/docker/docker /usr/local/bin/docker
           rm -rf /tmp/docker /tmp/docker.tgz
+
+          mkdir -p /usr/libexec/docker/cli-plugins
+          curl -fsSL -o /usr/libexec/docker/cli-plugins/docker-buildx \
+            https://github.com/docker/buildx/releases/download/v0.19.3/buildx-v0.19.3.linux-amd64
+          chmod +x /usr/libexec/docker/cli-plugins/docker-buildx
+
           docker --version
+          docker buildx version
 
       - name: Generate image tag
         id: tag
@@ -52,8 +60,8 @@ jobs:
           IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
           TAG="${{ steps.tag.outputs.tag }}"
           BUILD_TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-          docker build \
+          docker buildx build \
             --build-arg BUILD_TIMESTAMP="${BUILD_TIMESTAMP}" \
-            -t "${IMAGE}:${TAG}" -t "${IMAGE}:latest" .
-          docker push "${IMAGE}:${TAG}"
-          docker push "${IMAGE}:latest"
+            -t "${IMAGE}:${TAG}" -t "${IMAGE}:latest" \
+            --push \
+            .