ci: use the remote buildx driver, and build amd64 only

The build job failed at "Set up Docker Buildx":

    Error: ERROR: error for bootstrap "builder-...":
    Get "https://192.168.178.160:6443/apis/apps/v1/namespaces/gitea-runner/deployments/builder-...":
    tls: failed to verify certificate: x509: certificate signed by unknown authority

Cause
------
The `kubernetes` buildx driver talks to the cluster API to create its builder
pods. That needs the k3s CA certificate, which the job container does not
have - the `catthehacker/ubuntu:act-latest` image ships the public CA set
only. So the bootstrap could not verify the API server.

Fix
---
Switch to the `remote` driver, which talks straight to the buildkit daemon
already running in the cluster:

    driver: remote
    endpoint: tcp://buildkit.gitea-runner.svc:1234

No cluster API access is needed at all, so no kubeconfig is needed for the
build. This is the same pattern the wedding-photos workflow uses.

`endpoint` must be a top-level key, not a driver-opt: the action appends it
as the POSITIONAL argument to `buildx create --driver remote <endpoint>`, and
passing it in driver-opts yields "ERROR: no remote endpoint provided".

Also
----
The build was multi-arch (linux/amd64,linux/arm64), which runs qemu
emulation and crashes the buildkit pod on this NUC (exit 255,
SandboxChanged), after which the build hangs for many minutes. The cluster
is amd64, so the image is built for linux/amd64 only.

Verified: `docker buildx create --driver remote tcp://buildkit.gitea-runner.svc:1234`
succeeds from the runner's dind container and reports buildkit v0.29.0 with
linux/amd64 among its supported platforms.

.gitea/workflows/build_push.yml

@@ -41,16 +41,28 @@ jobs:
 
       - name: Create Kubeconfig
         run: |
-          mkdir $HOME/.kube
+          mkdir -p $HOME/.kube
           echo "${{ secrets.KUBEC_CONFIG_BUILDX }}" > $HOME/.kube/config
 
-      - name: Set up Docker Buildx
+      - name: Set up Docker Buildx (remote -> persistent buildkit daemon)
         uses: docker/setup-buildx-action@v3
         with:
-          driver: kubernetes
-          driver-opts: |
-            namespace=gitea-runner
-            qemu.install=true
+          # The `kubernetes` driver talks to the cluster API, which needs the
+          # k3s CA certificate.  The job container does not have it, so the
+          # bootstrap failed with "x509: certificate signed by unknown
+          # authority".
+          #
+          # The `remote` driver talks straight to the buildkit daemon that is
+          # already running in the cluster, so no cluster API access (and no
+          # kubeconfig) is needed at all.  This is the same pattern the
+          # wedding-photos workflow uses successfully.
+          #
+          # NOTE: `endpoint` must be passed as a top-level key.  The action
+          # appends it as the POSITIONAL argument to
+          # `buildx create --driver remote <endpoint>`; putting it in
+          # driver-opts instead yields "ERROR: no remote endpoint provided".
+          driver: remote
+          endpoint: tcp://buildkit.gitea-runner.svc:1234
 
       - name: Login to Docker Registry
         uses: docker/login-action@v3
@@ -65,7 +77,10 @@ jobs:
           context: .
           push: true
           file: base.Dockerfile
-          platforms: linux/amd64,linux/arm64
+          # amd64 only.  A multi-arch build runs qemu emulation, which crashes
+          # the buildkit pod on this NUC (exit 255, SandboxChanged) and the
+          # build then hangs for many minutes.  The cluster is amd64.
+          platforms: linux/amd64
           tags: |
             git.aridgwayweb.com/armistace/beer_base_image:latest
 
@@ -75,6 +90,6 @@ jobs:
           context: .
           push: true
           file: flask.Dockerfile
-          platforms: linux/amd64,linux/arm64
+          platforms: linux/amd64
           tags: |
             git.aridgwayweb.com/armistace/beer-data:latest