fix(ci): point DinD at the docker service alias, not localhost

The build job failed with:
  Cannot connect to the Docker daemon at tcp://localhost:2375.
  Is the docker daemon running?

Three things were wrong:

1. DOCKER_HOST was set to tcp://localhost:2375. The DinD daemon runs in
   the service sidecar container, not in the build container, so
   localhost was always going to refuse the connection. The correct host
   is the service alias 'docker'.

2. The docker:28.4.0-dind service was declared without an explicit
   alias. Without alias: docker, GitLab derives the hostname from the
   image string 'docker:28.4.0-dind', and since ':' is invalid in DNS,
   the 'docker' hostname never resolves. The explicit alias is required
   for tcp://docker:2375 to work at all.

3. docker:28.4.0-dind enables TLS by default and listens on 2376, but
   DOCKER_HOST points at 2375. Setting DOCKER_TLS_CERTDIR="" disables
   TLS so the daemon listens on plaintext 2375, matching DOCKER_HOST.

This mirrors the known-working pattern in the vnc-localidp pipeline
(docker:20.10.17-dind + alias: docker + DOCKER_HOST=tcp://docker:2375
+ DOCKER_TLS_CERTDIR=""). The TLS-defaults behavior has been unchanged
since docker 19.03, so the same pattern applies on 28.4.0.

.gitlab-ci.yml

@@ -40,7 +40,11 @@ variables:
   IMAGE: $CI_REGISTRY_IMAGE
   GIT_STRATEGY: clone
   DOCKER_DRIVER: overlay2
-  DOCKER_HOST: tcp://localhost:2375    
+  # DinD service is reached at the `docker` alias (set explicitly on the
+  # service below), not localhost. TLS disabled so the daemon listens on
+  # plaintext 2375 — same pattern as the working vnc-localidp pipeline.
+  DOCKER_HOST: tcp://docker:2375
+  DOCKER_TLS_CERTDIR: ""
 
 # ---------------------------------------------------------------------------
 # verify — required check on every MR into dev. No registry, no cluster.
@@ -69,7 +73,8 @@ build:
   stage: build
   image: docker:28.4.0
   services:
-    - docker:28.4.0-dind
+    - name: docker:28.4.0-dind
+      alias: docker
   rules:
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "dev"'
   before_script: