The upstream woodpeckerci/plugin-docker-buildx image does not trust the
internal CA, so buildx pushes to artifactapi fail on TLS verification.
Swap it for the CA-baked custom image published in the docker-internal
repo, in both the tag push (docker.yaml) and PR dry-run (build.yaml)
steps.