fix(ci): use docker-container driver so buildx emits attestations

The default buildx driver inside docker:29-dind is 'docker' (host daemon),
which cannot produce attestations. Even with default provenance enabled,
the docker driver silently drops attestation-related flags and emits a
bare single-image manifest. registry.itsh.dev (Zot with strict attestation
policy) rejects these with 'manifest invalid'.

Creating a 'docker-container' driver builder before each build gives
buildkit full export capabilities, matching both the Woodpecker plugin's
behavior and what works from local development machines.

.gitlab-ci.yml

@@ -16,6 +16,7 @@ backend:docker:
     DOCKER_TLS_CERTDIR: "/certs"
   before_script:
     - docker login -u "$REGISTRY_USER" -p "$REGISTRY_PASSWORD" $REGISTRY
+    - docker buildx create --name ci-builder --driver docker-container --use
   script:
     - docker buildx build --output "type=image,push=true,rewrite-timestamp=true" -f backend/deploy/Dockerfile -t "$BACKEND_IMAGE:${CI_COMMIT_SHORT_SHA}" backend/
   rules:
@@ -57,6 +58,7 @@ web:docker:
     DOCKER_TLS_CERTDIR: "/certs"
   before_script:
     - docker login -u "$REGISTRY_USER" -p "$REGISTRY_PASSWORD" $REGISTRY
+    - docker buildx create --name ci-builder --driver docker-container --use
   script:
     - |
       docker buildx build --output "type=image,push=true,rewrite-timestamp=true" \