fix(ci): route job-container DOCKER_HOST via host.docker.internal

127.0.0.1:2375 only worked from the runner container's own network
namespace (sibling to the dind sidecar in the same pod). The actual
job container that runs each step is spawned *by* that dind engine,
one level deeper, so its own loopback doesn't reach the sidecar.
host.docker.internal (mapped to the job container's real gateway via
--add-host=host.docker.internal:host-gateway in the runner's
container.options) reaches back to the dind engine that created it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.forgejo/workflows/build.yaml

@@ -14,7 +14,12 @@ jobs:
   build:
     runs-on: docker-ready
     env:
-      DOCKER_HOST: tcp://127.0.0.1:2375
+      # 127.0.0.1 doesn't work here: the job container is nested one level
+      # inside the runner pod's dind sidecar, so its own loopback isn't the
+      # sidecar's. host.docker.internal (mapped via --add-host in the
+      # runner's container.options) reaches back to the dind engine that
+      # actually spawned this container.
+      DOCKER_HOST: tcp://host.docker.internal:2375
       DOCKER_BUILDKIT: "1"
     steps:
       - name: Checkout