fix: use default buildx without attestations for unprivileged runner (#216)

Remove the setup-buildx-action step that was failing with unshare errors
when trying to create a docker-container builder.

Instead, use the default buildx that comes with dockerd and disable
attestation features (provenance and sbom) that require additional
mount operations.

This simpler approach should work within the constraints of the
unprivileged CI runner.

Reviewed-on: graham/towerops-web#216

.forgejo/workflows/production.yaml

@@ -33,15 +33,6 @@ jobs:
             timeout 30 bash -c 'until docker info > /dev/null 2>&1; do sleep 1; done'
           fi
 
-      - name: Set up Docker Buildx
-        uses: https://github.com/docker/setup-buildx-action@v3
-        with:
-          driver: docker-container
-          driver-opts: |
-            image=moby/buildkit:latest
-          install: true
-          cleanup: true
-
       - name: Generate image tag
         id: tag
         run: |
@@ -65,6 +56,8 @@ jobs:
           context: .
           file: k8s/Dockerfile
           push: true
+          provenance: false
+          sbom: false
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.tag }}
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production