fix(ci): use localhost, not the docker: alias, to reach dind

This runner is GitLab's Kubernetes executor (pod names in the job log:
runner-uncqet63-project-499-concurrent-*), where all containers in a job
share one pod's network namespace. The docker: service-alias hostname is
a Docker-executor convention (bridge network + DNS alias) and doesn't
apply here — tcp://docker:2375 correctly read the variable but nothing
answered at that name. localhost is the right host for this executor.

.gitlab-ci.yml

@@ -109,11 +109,14 @@ build:
     # surfacing as "Cannot connect to the Docker daemon at
     # unix:///var/run/docker.sock" even though $CI_REGISTRY login already
     # succeeded (that's a separate connection, straight to the registry,
-    # not through the daemon). Disabling TLS between the two containers of
-    # the same job is standard for GitLab's Kubernetes executor — they
-    # share a pod network namespace, so plaintext here isn't exposed
-    # outside the job.
-    DOCKER_HOST: tcp://docker:2375
+    # not through the daemon). DOCKER_TLS_CERTDIR="" disables that TLS
+    # requirement. Host is `localhost`, not the service alias `docker` —
+    # this runner uses GitLab's Kubernetes executor, where every container
+    # in a job shares one pod's network namespace, unlike the Docker
+    # executor's bridge network (where the service-name alias is how you'd
+    # reach it instead). Confirmed from the job log: pod names like
+    # runner-uncqet63-project-499-concurrent-* are Kubernetes-executor pods.
+    DOCKER_HOST: tcp://localhost:2375
     DOCKER_TLS_CERTDIR: ""
   before_script:
     # $CI_REGISTRY / $CI_REGISTRY_USER / $CI_REGISTRY_PASSWORD are predefined