fix(ci): tolerate buildx's pretty-printed metadata-file JSON when extracting digest

docker buildx --metadata-file writes pretty-printed JSON (space after
the colon: "containerimage.digest": "sha256:..."), but the digest
grep required compact JSON with no space, so it always matched
nothing. That produced an empty $digest, which the script correctly
treated as fatal and exited on - right after the first service
(gateway) had already built and pushed successfully, silently
aborting the rest of the service loop. Verified the fix against a
real locally-generated metadata file from the same buildx command.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.forgejo/workflows/build.yaml

@@ -140,7 +140,10 @@ jobs:
               -t "$image_ref" \
               .
 
-            digest="$(grep -o '"containerimage.digest":"sha256:[^"]*"' "$metadata_file" | cut -d'"' -f4)"
+            # buildx writes the metadata file pretty-printed (space after the
+            # colon), which the old compact-JSON-only pattern never matched -
+            # tolerate optional whitespace and extract the digest directly.
+            digest="$(grep -o '"containerimage\.digest"[[:space:]]*:[[:space:]]*"sha256:[^"]*"' "$metadata_file" | grep -o 'sha256:[^"]*')"
             if [ -z "$digest" ]; then
               echo "Failed to determine digest for $service" >&2
               exit 1