fix: use legacy docker build without BuildKit for unprivileged runner (#220)

BuildKit (used by build-push-action and buildx) requires privileged mount
operations that fail on unprivileged runners with vfs storage driver.

Solution: Replace build-push-action with plain 'docker build' and 'docker push'
commands with DOCKER_BUILDKIT=0 to use the legacy builder.

Trade-offs:
- Works on unprivileged runners without privileged access
- Slower builds (no BuildKit caching/parallelism)
- No build attestations/provenance (already disabled)

Reviewed-on: graham/towerops-web#220

.forgejo/workflows/production.yaml

@@ -120,25 +120,23 @@ jobs:
           username: ${{ secrets.REGISTRY_USER }}
           password: ${{ secrets.REGISTRY_PASSWORD }}
 
-      - name: Set up Docker Buildx
-        uses: https://github.com/docker/setup-buildx-action@v3
-        with:
-          driver: docker
-          install: true
-
       - name: Build and push Docker image
-        uses: https://github.com/docker/build-push-action@v5
-        with:
-          context: .
-          file: k8s/Dockerfile
-          push: true
-          provenance: false
-          sbom: false
-          tags: |
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.tag }}
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production
-          build-args: |
-            MIX_ENV=prod
+        env:
+          DOCKER_BUILDKIT: 0
+        run: |
+          IMAGE_TAG="${{ steps.tag.outputs.tag }}"
+
+          # Build image without BuildKit (required for unprivileged runner)
+          docker build \
+            --build-arg MIX_ENV=prod \
+            --file k8s/Dockerfile \
+            --tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}" \
+            --tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production" \
+            .
+
+          # Push both tags
+          docker push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}"
+          docker push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production"
 
       - name: Update deployment manifest
         run: |