- Remove sed substitution from pipeline (no more __PLACEHOLDER__ pattern)
- Nomad template{} reads mmd/* keys from Consul KV at allocation time
- Secrets never touch git or pipeline logs
- Remove Gitea secrets dependency for app secrets (only HARBOR_ROBOT_TOKEN needed)
buildx is only needed for multi-platform builds.
For a single-platform debian-host runner, plain docker
build + push is simpler and has no permission issues.
Removed:
- docker/setup-buildx-action (EACCES /tmp/buildx/certs)
- docker/build-push-action
- buildx context setup steps
- BUILDX_CONFIG env var
docker-container driver (default) tries to spin up a BuildKit
container which can fail on host runners. 'driver: docker' uses
the host daemon directly — simpler and more reliable.
