Enable pinned BuildKit support on the Railiance CI runner

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

scripts/ci-docker.sh

@@ -0,0 +1,19 @@
+# Source from a CI step after archive checkout. Isolate tool and login state
+# for this invocation; do not modify the runner's persistent Docker config.
+set -eu
+VERGABE_DOCKER_TOOLS="$(mktemp -d)"
+export DOCKER_CONFIG="${VERGABE_DOCKER_TOOLS}/config"
+trap 'rm -rf "${VERGABE_DOCKER_TOOLS}"' EXIT
+mkdir -p "${VERGABE_DOCKER_TOOLS}/bin" "${DOCKER_CONFIG}/cli-plugins"
+wget -qO "${VERGABE_DOCKER_TOOLS}/docker.tgz" \
+  https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz
+tar xzf "${VERGABE_DOCKER_TOOLS}/docker.tgz" --strip-components=1 \
+  -C "${VERGABE_DOCKER_TOOLS}/bin" docker/docker
+wget -qO "${DOCKER_CONFIG}/cli-plugins/docker-buildx" \
+  https://github.com/docker/buildx/releases/download/v0.19.3/buildx-v0.19.3.linux-amd64
+# Pinned from the upstream v0.19.3 checksums.txt release asset.
+echo "32ed111e941e385c2fb8261eba06a4056915718fd606f8278834ac1931d261a2  ${DOCKER_CONFIG}/cli-plugins/docker-buildx" | sha256sum -c -
+chmod +x "${DOCKER_CONFIG}/cli-plugins/docker-buildx"
+export PATH="${VERGABE_DOCKER_TOOLS}/bin:${PATH}"
+export DOCKER_BUILDKIT=1
+docker buildx version