fix: use existing Docker daemon instead of starting new one (#226)

The CI runner already has a working Docker daemon and the runner user
is in the docker group. All previous failures were caused by the workflow
trying to start a NEW dockerd instance with vfs storage driver.

Solution: Remove all daemon startup code and just use the existing Docker
daemon directly. The runner user already has access via group membership.

Verified on ci host:
- Docker service running: overlayfs storage driver
- runner user in docker group: uid=1001(runner) groups=1001(runner),989(docker)
- docker info works as runner user

This is the simplest solution and should have been tried first.

Reviewed-on: graham/towerops-web#226

.forgejo/workflows/production.yaml

@@ -100,35 +100,26 @@ jobs:
           echo "tag=${TAG}" >> $GITHUB_OUTPUT
           echo "Full image tag: ${TAG}"
 
-      - name: Install img
-        run: |
-          curl -fsSL https://github.com/genuinetools/img/releases/download/v0.5.11/img-linux-amd64 -o /tmp/img
-          sudo install /tmp/img /usr/local/bin/img
-          rm /tmp/img
-
-      - name: Build and push with img
+      - name: Build and push Docker image
         run: |
           IMAGE_TAG="${{ steps.tag.outputs.tag }}"
 
-          # Build with img (completely unprivileged, no capabilities needed)
-          img build \
+          # Build using existing Docker daemon (runner user is in docker group)
+          docker build \
             --build-arg MIX_ENV=prod \
             --file k8s/Dockerfile \
             --tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}" \
+            --tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production" \
             .
 
-          # Login and push
-          img login \
-            -u "${{ secrets.REGISTRY_USER }}" \
-            -p "${{ secrets.REGISTRY_PASSWORD }}" \
+          # Login and push both tags
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login \
+            --username "${{ secrets.REGISTRY_USER }}" \
+            --password-stdin \
             "${{ secrets.REGISTRY_URL }}"
 
-          img push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}"
-
-          # Tag and push production
-          img tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}" \
-                  "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production"
-          img push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production"
+          docker push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}"
+          docker push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production"
 
   update-manifest:
     name: Update Deployment Manifest