Add CA-baked plugin-docker-buildx image + buildah CI

Bake the internal Vault-PKI CA into a rebuild of
woodpeckerci/plugin-docker-buildx so k8s buildx jobs can push to
artifactapi's docker-internal registry over TLS.

- Dockerfile: copy unkin-ca.crt into /etc/docker/certs.d/<registry>/ca.crt
  and the system trust store
- unkin-ca.crt: vault-ca-cert bundle (root + intermediate)
- .woodpecker/build.yaml: PR gate, buildah build-only
- .woodpecker/release.yaml: on v* tag, buildah build + credless push to
  docker-internal with --tls-verify=false (bootstrap)

README.md

@@ -1,3 +1,30 @@
 # plugin-docker-buildx
 
-Woodpecker plugin-docker-buildx image with the internal Vault-PKI CA baked in (trusts artifactapi)
+A drop-in rebuild of `woodpeckerci/plugin-docker-buildx` with the internal
+Vault-PKI CA baked in.
+
+## Why
+
+The stock `woodpeckerci/plugin-docker-buildx` image does not trust artifactapi's
+internal CA, so k8s Woodpecker buildx jobs cannot push to
+`artifactapi.k8s.syd1.au.unkin.net/docker-internal/*` — buildkit needs
+`/etc/docker/certs.d/<registry>/ca.crt` inside the plugin container, and the k8s
+backend has no way to inject it.
+
+This image copies the `vault-ca-cert` bundle (root + intermediate) into that path
+plus the system trust store, so pipelines can `settings.registry:
+artifactapi.k8s.syd1.au.unkin.net` and push over TLS.
+
+## Published as
+
+`artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:<tag>` (and `:latest`)
+
+## Bootstrap
+
+This image is itself built and pushed by **buildah** (`.woodpecker/release.yaml`),
+not by buildx, using `buildah push --tls-verify=false`. buildah is used precisely
+because it sidesteps the buildx CA-trust problem that this image exists to fix —
+its own push therefore cannot rely on that trust yet.
+
+Once published, point Woodpecker docker-buildx steps at this image instead of the
+upstream one to push to the docker-internal registry.