woodpecker: quote buildah commands (YAML colon-space parse fix)

woodpecker interpolates ${CI_COMMIT_TAG} into the raw pipeline text before YAML
parsing; when empty, '-t $${IMG}:${CI_COMMIT_TAG} .' collapses to '... : .'
and the colon-space is parsed as a map key ('cannot unmarshal map ... into a
string value'). Quote every buildah command so it stays a scalar.

.woodpecker/build.yaml

@@ -7,7 +7,7 @@ steps:
   - name: build
     image: quay.io/buildah/stable
     commands:
-      - buildah build --isolation chroot --storage-driver vfs -t plugin-docker-buildx:${CI_COMMIT_SHA} .
+      - "buildah build --isolation chroot --storage-driver vfs -t plugin-docker-buildx:${CI_COMMIT_SHA} ."
     backend_options:
       kubernetes:
         serviceAccountName: plugin-docker-buildx

.woodpecker/release.yaml

@@ -11,15 +11,19 @@ steps:
   # jellyfin-ha). --tls-verify=false is a deliberate bootstrap: THIS image is what
   # teaches k8s buildx to trust artifactapi's internal CA, so its own push cannot
   # yet rely on that trust.
+  #
+  # Commands are quoted: woodpecker templates ${CI_COMMIT_TAG} into the raw YAML
+  # before parsing, so an unquoted "-t $${IMG}:${CI_COMMIT_TAG} ." can collapse to
+  # "... -t $${IMG}: ." and YAML then reads the "colon-space" as a map key.
   - name: release
     image: quay.io/buildah/stable
     environment:
       IMG: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx
     commands:
-      - buildah build --isolation chroot --storage-driver vfs -t $${IMG}:${CI_COMMIT_TAG} .
+      - "buildah build --isolation chroot --storage-driver vfs -t $${IMG}:${CI_COMMIT_TAG} ."
-      - buildah tag --storage-driver vfs $${IMG}:${CI_COMMIT_TAG} $${IMG}:latest
+      - "buildah tag --storage-driver vfs $${IMG}:${CI_COMMIT_TAG} $${IMG}:latest"
-      - buildah push --storage-driver vfs --tls-verify=false $${IMG}:${CI_COMMIT_TAG}
+      - "buildah push --storage-driver vfs --tls-verify=false $${IMG}:${CI_COMMIT_TAG}"
-      - buildah push --storage-driver vfs --tls-verify=false $${IMG}:latest
+      - "buildah push --storage-driver vfs --tls-verify=false $${IMG}:latest"
     backend_options:
       kubernetes:
         serviceAccountName: plugin-docker-buildx