ci: prebaked job image + fix buildx discovery under DOCKER_CONFIG

download.docker.com resets intermittently from the cluster network, and
/root/.docker/cli-plugins is not searched when the workflow sets
DOCKER_CONFIG=/tmp/.docker ('Docker buildx is required').

- jobs on the apollo runner use act-job:20 (.gitea/job-image: node 20 +
  docker CLI + buildx in system plugin paths) - no runtime downloads
- other runners fall back to installing, now into a system plugin path

.gitea/job-image/Dockerfile

@@ -0,0 +1,14 @@
+# CI job image for the Gitea Actions runners.
+#
+# JS actions (actions/checkout, docker/build-push-action) execute INSIDE the
+# job container and need node; builds talk to the runner's daemon through the
+# mounted /var/run/docker.sock, so this image needs the docker CLI + buildx
+# but no daemon. Baking them in means jobs never download binaries at runtime:
+# download.docker.com and github.com releases are unreachable (connection
+# reset) from the cluster's network.
+#
+# Tagged as src.panahifar.ir/ahp/act-job:20 (node 20 / bookworm).
+FROM node:20-bookworm
+
+COPY --from=docker:27-cli /usr/local/bin/docker /usr/local/bin/docker
+COPY --from=docker:27-cli /usr/local/libexec/docker/cli-plugins/docker-buildx /usr/local/libexec/docker/cli-plugins/docker-buildx