ci: ride out docker daemon + registry flakes

Forgejo act_runner mounts the host docker socket into the job
container; the daemon sometimes takes a beat to answer, which has
been surfacing as intermittent "unable to connect to docker" failures
on login. Gate the build on a `docker info` poll (up to 30s) so later
steps don't race the socket, and wrap login + buildx push in a 3-try
exponential-backoff (2s/4s/8s) so a transient registry hiccup doesn't
require a manual workflow re-run.

.forgejo/workflows/build.yaml

@@ -44,6 +44,21 @@ jobs:
           docker --version
           docker buildx version
 
+      - name: Wait for Docker daemon
+        run: |
+          # act_runner mounts the host docker socket into the job, but
+          # the daemon side sometimes takes a moment to answer. Poll
+          # `docker info` until it responds so the login/build steps
+          # below don't race the socket and fail with "unable to
+          # connect to docker".
+          for i in $(seq 1 30); do
+            docker info >/dev/null 2>&1 && exit 0
+            echo "Waiting for Docker daemon... ($i/30)"
+            sleep 1
+          done
+          echo "Docker daemon never became reachable" >&2
+          exit 1
+
       - name: Generate image tag
         id: tag
         run: |
@@ -53,15 +68,51 @@ jobs:
           echo "tag=${TAG}" >> $GITHUB_OUTPUT
 
       - name: Log in to container registry
-        run: echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login ${{ secrets.REGISTRY_URL }} -u ${{ secrets.REGISTRY_USER }} --password-stdin
+        run: |
+          # Exponential backoff (2s, 4s, 8s) around docker login to
+          # ride out transient registry blips without failing the
+          # whole workflow.
+          attempt=1
+          max_attempts=3
+          while : ; do
+            if echo "${{ secrets.REGISTRY_PASSWORD }}" | \
+                docker login "${{ secrets.REGISTRY_URL }}" \
+                  -u "${{ secrets.REGISTRY_USER }}" \
+                  --password-stdin; then
+              exit 0
+            fi
+            if [ "$attempt" -ge "$max_attempts" ]; then
+              echo "docker login failed after $attempt attempts" >&2
+              exit 1
+            fi
+            delay=$((2 ** attempt))
+            echo "docker login attempt $attempt failed; retrying in ${delay}s"
+            sleep "$delay"
+            attempt=$((attempt + 1))
+          done
 
       - name: Build and push Docker image
         run: |
           IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
           TAG="${{ steps.tag.outputs.tag }}"
           BUILD_TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-          docker buildx build \
-            --build-arg BUILD_TIMESTAMP="${BUILD_TIMESTAMP}" \
-            -t "${IMAGE}:${TAG}" -t "${IMAGE}:latest" \
-            --push \
-            .
+
+          attempt=1
+          max_attempts=3
+          while : ; do
+            if docker buildx build \
+                --build-arg BUILD_TIMESTAMP="${BUILD_TIMESTAMP}" \
+                -t "${IMAGE}:${TAG}" -t "${IMAGE}:latest" \
+                --push \
+                .; then
+              exit 0
+            fi
+            if [ "$attempt" -ge "$max_attempts" ]; then
+              echo "docker buildx build failed after $attempt attempts" >&2
+              exit 1
+            fi
+            delay=$((2 ** attempt))
+            echo "docker buildx build attempt $attempt failed; retrying in ${delay}s"
+            sleep "$delay"
+            attempt=$((attempt + 1))
+          done