fix(ci): point docker client at dind over plaintext TCP

registry login now succeeds (CI_REGISTRY populated correctly) but the
build step failed separately: docker:27-dind defaults to TLS on :2376,
which the docker:27-cli client image doesn't know to use without a
mounted cert dir. DOCKER_HOST=tcp://docker:2375 + DOCKER_TLS_CERTDIR=""
is the standard fix for GitLab's Kubernetes executor, where both
containers share the job's pod network namespace.

.gitlab-ci.yml

@@ -102,6 +102,19 @@ build:
     - docker:27-dind
   rules:
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "dev"'
+  variables:
+    # docker:27-dind defaults to TLS on :2376 with certs under
+    # /certs/client, which this client image never mounts — the dind
+    # service comes up fine but the docker:27-cli image can't find it,
+    # surfacing as "Cannot connect to the Docker daemon at
+    # unix:///var/run/docker.sock" even though $CI_REGISTRY login already
+    # succeeded (that's a separate connection, straight to the registry,
+    # not through the daemon). Disabling TLS between the two containers of
+    # the same job is standard for GitLab's Kubernetes executor — they
+    # share a pod network namespace, so plaintext here isn't exposed
+    # outside the job.
+    DOCKER_HOST: tcp://docker:2375
+    DOCKER_TLS_CERTDIR: ""
   before_script:
     # $CI_REGISTRY / $CI_REGISTRY_USER / $CI_REGISTRY_PASSWORD are predefined
     # GitLab CI variables — populated automatically now that this project's