fix(ci): bootstrap pipeline with upstream plugin; remove privileged mode

[arnfred]

Root causes

Three issues combined to break the Woodpecker CI pipeline:

1. privileged: true starts an inner dockerd. The Woodpecker agent already mounts the host docker socket into the plugin container. With privileged: true set, dockerd-entrypoint.sh also starts its own dockerd inside the container. The two race against each other during socket availability checks, causing intermittent failures.

2. gowerstreet/plugin-docker-buildx:latest only has an arm64 build. The CI runner is amd64, so the plugin ran under QEMU emulation. The emulated dockerd timed out before becoming ready, making the pipeline consistently fail.

3. output: type=docker can't share the image between steps. Loading into a docker-format output only places the image in the plugin's ephemeral dockerd, not the host's — so a subsequent step can't pull it by tag.

Fix

• build-staging step: switched to woodpeckerci/plugin-docker-buildx (upstream, has native amd64+arm64 builds). Removed privileged: true. Pushes a staging-${CI_PIPELINE_NUMBER} tag to Docker Hub instead of a local docker-format load.
• publish step: pulls the freshly pushed staging image as the plugin image, verifying the new build actually works as a plugin before it becomes :latest. Removed privileged: true.

Once our fork consistently publishes both architectures, the build-staging step can be switched back to gowerstreet/plugin-docker-buildx.

Test plan

• Push to main triggers the pipeline
• build-staging step completes without dockerd timeout errors
• staging-<N> tag appears on Docker Hub for gowerstreet/plugin-docker-buildx
• publish step pulls and uses the staging image successfully
• :latest and :<N> tags are published as multi-arch (amd64 + arm64)

🤖 Generated with Claude Code