ci: use CA-baked plugin-docker-buildx image for artifactapi push

The upstream woodpeckerci/plugin-docker-buildx image does not trust the
internal CA, so buildx pushes to the artifactapi local docker registry
fail on TLS verification. Switch the docker push step to the CA-baked
plugin-docker-buildx image published to docker-internal, which bundles
the internal CA and pushes cleanly.

.woodpecker/docker.yaml

@@ -1,6 +1,6 @@
 # Build and push the pdbmux container image on a v* tag. pdbmux is a k8s-only
 # daemon (deployed via argocd-apps), so it ships as an image. Mirrors the estate
-# convention: the woodpeckerci/plugin-docker-buildx plugin pushes to the
+# convention: the CA-baked plugin-docker-buildx image pushes to the
 # artifactapi local docker registry (unauthenticated in-cluster push).
 when:
   - event: tag
@@ -8,7 +8,7 @@ when:
 
 steps:
   - name: docker
-    image: woodpeckerci/plugin-docker-buildx
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest
     settings:
       registry: artifactapi.k8s.syd1.au.unkin.net
       repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/pdbmux