Build and push in one step so buildx container-driver runners work

.gitea/workflows/build.yml

@@ -25,15 +25,13 @@ jobs:
       - uses: actions/checkout@v4
       - name: Log in to container registry
         run: echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.gbrown.org -u "${{ secrets.REGISTRY_USER }}" --password-stdin
-      # Fully-qualified tags from the start: unqualified names like
-      # `agentchat:latest` break on podman-backed runners, which resolve them
-      # to docker.io/library/* instead of the local build.
-      - name: Build image
-        run: docker build -f docker/Dockerfile -t git.gbrown.org/gib/agentchat:${{ gitea.sha }} -t git.gbrown.org/gib/agentchat:latest .
-      - name: Push image
-        run: |
-          docker push git.gbrown.org/gib/agentchat:${{ gitea.sha }}
-          docker push git.gbrown.org/gib/agentchat:latest
+      # One build-and-push step, fully-qualified tags, --push from the builder.
+      # This is the only form that works across all the runners: unqualified
+      # names resolve to docker.io/library/* on podman-backed daemons, and
+      # buildx docker-container drivers keep plain builds in the build cache
+      # where a separate push step can't see them.
+      - name: Build and push image
+        run: docker build --push -f docker/Dockerfile -t git.gbrown.org/gib/agentchat:${{ gitea.sha }} -t git.gbrown.org/gib/agentchat:latest .
 
       # Watchtower on the VPS updates labelled containers nightly at 04:30; this
       # asks it to do so immediately. Non-fatal: the sweep still catches it.