Publish with a builder on the host's network

The v2026.9.20 publish (job 513) built both platforms, then failed to
push:

  failed to fetch oauth token: Post "https://git.coffeylabs.org/jwt/auth":
  dial tcp 172.30.0.2:443: connect: connection refused

buildx's docker-container builder is a container of its own on the host's
daemon, and it does the push, token and all. On the network it was
created on, git.coffeylabs.org resolves to an internal address with
nothing listening on 443. The job's own `docker login` worked because it
goes through the host daemon. inbuxa-admin's first release failed the
same way.

The builder now runs on the host's network, so it resolves the name as
the login does. Only the token request goes to git.coffeylabs.org; image
layers still go to registry.coffeylabs.org, the registry's DNS-only name.
It gets a new name, ci-builder-host: `ci-builder` is a long-lived
container shared between jobs, and `create || use` would keep reusing it
on its old network.

.gitlab-ci.yml

@@ -141,7 +141,16 @@ publish:
   before_script:
     - echo "$CI_REGISTRY_PASSWORD" | docker login -u "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
     - docker run --privileged --rm tonistiigi/binfmt --install arm64
-    - docker buildx create --use --name ci-builder --driver docker-container || docker buildx use ci-builder
+    # The builder runs as a container on the host's daemon and does the push
+    # itself, including fetching a registry token from git.coffeylabs.org.
+    # On the runner's network that name resolves to an internal address
+    # (172.30.0.2) with nothing on 443, so the token request was refused and
+    # the push failed at the last step (job 513). On the host's network the
+    # name resolves as it does for `docker login` above. Only the token request
+    # uses it; layers still go to the registry's own DNS-only name. A new name,
+    # because `ci-builder` is a long-lived container shared between jobs and
+    # would keep whatever network it was created on.
+    - docker buildx create --use --name ci-builder-host --driver docker-container --driver-opt network=host || docker buildx use ci-builder-host
   script:
     - |
       docker buildx build \