ci: add docker.io mirror to buildkitd config for registry-cache

BuildKit docker-container driver runs isolated from DinD daemon config,
so it needs its own mirror declaration to route docker.io pulls through
the cluster-local pull-through cache instead of Cloudflare CDN directly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -40,6 +40,13 @@ jobs:
               http = true
               insecure = true
 
+            [registry."docker.io"]
+              mirrors = ["registry-cache.registry-cache.svc.cluster.local:5000"]
+
+            [registry."registry-cache.registry-cache.svc.cluster.local:5000"]
+              http = true
+              insecure = true
+
       - name: Build and push bot image
         uses: docker/build-push-action@v3
         with: