Buildkit in the upstream woodpeckerci/plugin-docker-buildx image does not trust the artifactapi internal Vault CA, so pushes to docker-internal fail on TLS.
- Switch the docker.yaml push step to the CA-baked custom plugin image
- Switch the build.yaml PR dry-run step to the same custom image