GITOPS_PAT auth was failing against Forgejo. GitHub is the source of
truth for nxtgauge-gitops; push there and let sync-to-forgejo.yml
relay to Forgejo, which Flux actually watches.
Third bug in the same chain: GITEOPS_REPO/GITEOPS_SSH_KEY were
referenced but never actually configured as repo secrets (only
REGISTRY_*, GITOPS_GITHUB_*, and GITOPS_PAT exist) — the digest
extraction fix got the job to actually reach this step, where it then
failed instantly and silently (a bare `test -n` with no echo). Switch
to an HTTPS clone with GITOPS_PAT, matching nxtgauge-backend-rust's
already-working workflow.
The docker gateway fix got the build to actually run and push
successfully, but the digest-extraction grep required a compact
":" with no space, while buildx writes the metadata file
pretty-printed ("containerimage.digest": "sha256:..."), so the match
always failed, aborting the step post-push and skipping the
GitOps-release step entirely. Match nxtgauge-backend-rust's
whitespace-tolerant pattern.
Every build on this branch has been failing with "Cannot connect to
the Docker daemon at tcp://127.0.0.1:2375" — the job container is
nested one level inside the runner pod's dind sidecar, so its own
loopback isn't the sidecar's. nxtgauge-backend-rust already carries
the fix (read the container's default-route gateway from
/proc/net/route); porting the same step here.
