ci: image builds pull through a mirror instead of rate-limited Docker Hub - #5377

Approve at 301304ad. The mirror only affects how CI pulls Docker Hub images while building test images. Nothing is pushed or published through it, no credentials are involved, and nothing that was pinned before is pinned any less now.

Checked

• Scope. These three setup-buildx-action steps are the only buildx setups in .github/workflows. All three build CI-only images:
  • ci.yml uses push: false.
  • regression.yml and fast-video-validation.yml use load: true and then docker run the local tag.
  • No workflow logs in to Docker Hub, so no credentials can reach the mirror. Release and publish workflows are untouched.
• What gets mirrored. Only the docker.io registry. Every FROM in the repo pulls node from Docker Hub (Dockerfile.test, Dockerfile.render, gcp-cloud-run/Dockerfile), and nothing pulls from another registry. When the mirror misses, BuildKit falls back to Docker Hub.
• Pinning. No base image was pinned by digest before this PR. Both node:22.23.3-bookworm-slim and the BuildKit image were tag references, and moby/buildkit:buildx-stable-1 was already the action's default. Moving that same tag to mirror.gcr.io adds no floating reference.
• Digests match. I queried both registries directly at review time, and each tag resolves to the same manifest digest on both:
  • library/node:22.23.3-bookworm-slim → sha256:c3de60bf…978392;
  • moby/buildkit:buildx-stable-1 → sha256:cec9f139…2e3dea.
  • Layers are content-addressed against that manifest, so the mirror can serve a given digest's content only as it is.
• Trust change. Tag resolution now also trusts Google's documented Docker Hub cache, alongside Docker Hub itself. That's a reasonable trade for CI-only, unpublished images.
• The CI run uses it. The shard-10 log shows buildx create … --driver-opt image=mirror.gcr.io/moby/buildkit:buildx-stable-1, the pull from mirror.gcr.io, and mirrors = ['mirror.gcr.io'] in the loaded buildkitd.toml. All 10 shards passed in the first regression run at this head. The extra buildkitd entitlement flags in that log are the action's defaults and are the same as on main.
• Self-filter. Adding .github/workflows/regression.yml to the regression change filter is right. Before, a PR that edited the shards' own workflow skipped those shards.

Nits (none blocking)

• buildx-stable-1 is a floating tag on either registry. Pinning it as mirror.gcr.io/moby/buildkit:buildx-stable-1@sha256:… would make the builder reproducible. That's separate hardening, not something this PR loosened.
• A cache can lag a tag that gets re-pushed. Official node images are rebuilt under the same tag for Debian updates, so the mirror may briefly serve the previous digest. The same digest stays reachable from Docker Hub, and the GHA build cache keys follow whichever digest comes back, so it's harmless.

This approval waits for the required checks at this head.

— Rames