fix(ci): resolve dind daemon's actual gateway IP instead of 127.0.0.1

First real run after fixing the registry/secrets config failed immediately
with "Cannot connect to the Docker daemon at tcp://127.0.0.1:2375" - the
job container is nested inside the runner pod's dind sidecar, so its own
loopback isn't the sidecar's. Port the gateway-detection step already
working in nxtgauge-backend-rust's workflow.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.forgejo/workflows/build.yaml

@@ -14,7 +14,6 @@ jobs:
   build:
     runs-on: docker-ready
     env:
-      DOCKER_HOST: tcp://127.0.0.1:2375
       DOCKER_BUILDKIT: "1"
     steps:
       - name: Checkout
@@ -22,6 +21,19 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Point DOCKER_HOST at this container's own gateway
+        run: |
+          set -euo pipefail
+          # 127.0.0.1 doesn't work: the job container is nested one level
+          # inside the runner pod's dind sidecar, so its own loopback isn't
+          # the sidecar's. Read the container's actual default-route gateway
+          # from /proc/net/route instead (the dind engine that spawned it).
+          GATEWAY="$(awk '$2 == "00000000" {print $3}' /proc/net/route | head -1 | \
+            sed -E 's/(..)(..)(..)(..)/0x\4 0x\3 0x\2 0x\1/' | \
+            { read -r a b c d; printf '%d.%d.%d.%d' "$a" "$b" "$c" "$d"; })"
+          echo "Detected docker host gateway: $GATEWAY"
+          echo "DOCKER_HOST=tcp://$GATEWAY:2375" >> "$GITHUB_ENV"
+
       - name: Set up Docker Buildx
         run: |
           set -euo pipefail