ci: run registry-side imagetools jobs on current buildx

The blacksmith.sh runner migration (91fae5f8cb) mechanically replaced
docker/setup-buildx-action with useblacksmith/setup-docker-builder.
Side effect: buildx dropped from v0.38.0 (setup-buildx-action installs
the latest release) to the Blacksmith action's default pin, v0.23.0 -
and v0.23.0's `imagetools create` cannot publish a manifest list to
Docker Hub. The index commit on the target tag dies with:

  failed commit on ref "index-sha256:...": unexpected status from GET
  request to .../manifests/rc.2-v0.22.3: 404 Not Found

Stable v0.22.3 rc.1 and rc.2 both failed deterministically in
"Create both immutable versioned manifest lists" (3/3 attempts each,
identical error); the same step succeeded with buildx v0.38.0 in the
v0.22.2 release. Per-arch pushes go through BuildKit and are
unaffected, so the build jobs keep the action default.

Pin `buildx-version: latest` on the setup-docker-builder steps of
every job that only does registry-side imagetools work: docker.yml
release-publish-manifest and merge, sandbox-image.yml merge, and both
sequencer alias-promotion jobs (promote_stable() in
scripts/releases/docker.py runs imagetools create for
vX.Y.Z/stable/latest). This restores the pre-migration toolchain for
exactly those jobs.

.github/workflows/docker.yml

@@ -471,10 +471,16 @@ jobs:
         id: buildx
         continue-on-error: true
         uses: useblacksmith/setup-docker-builder@19215110ab936351210feebdfa5b440b4493e184  # v2
+        with:
+          # the action's default buildx (v0.23.0) fails to push manifest lists to Docker Hub
+          buildx-version: latest
 
       - name: Set up Docker Buildx (retry)
         if: steps.buildx.outcome == 'failure'
         uses: useblacksmith/setup-docker-builder@19215110ab936351210feebdfa5b440b4493e184  # v2
+        with:
+          # the action's default buildx (v0.23.0) fails to push manifest lists to Docker Hub
+          buildx-version: latest
 
       - name: Log in to Docker Hub
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
@@ -651,10 +657,16 @@ jobs:
         id: buildx
         continue-on-error: true
         uses: useblacksmith/setup-docker-builder@19215110ab936351210feebdfa5b440b4493e184  # v2
+        with:
+          # the action's default buildx (v0.23.0) fails to push manifest lists to Docker Hub
+          buildx-version: latest
 
       - name: Set up Docker Buildx (retry)
         if: steps.buildx.outcome == 'failure'
         uses: useblacksmith/setup-docker-builder@19215110ab936351210feebdfa5b440b4493e184  # v2
+        with:
+          # the action's default buildx (v0.23.0) fails to push manifest lists to Docker Hub
+          buildx-version: latest
 
       - name: Log in to Docker Hub
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0

.github/workflows/sandbox-image.yml

@@ -143,6 +143,9 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: useblacksmith/setup-docker-builder@19215110ab936351210feebdfa5b440b4493e184  # v2
+        with:
+          # the action's default buildx (v0.23.0) fails to push manifest lists to Docker Hub
+          buildx-version: latest
 
       - name: Log in to Docker Hub
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0

.github/workflows/stable-release-publication.yml

@@ -48,6 +48,9 @@ jobs:
           cache-python: false
       - name: Set up Docker Buildx for ordered alias promotion
         uses: useblacksmith/setup-docker-builder@19215110ab936351210feebdfa5b440b4493e184  # v2
+        with:
+          # the action's default buildx (v0.23.0) fails to push manifest lists to Docker Hub
+          buildx-version: latest
       - name: Log in to Docker Hub for ordered alias promotion
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:

.github/workflows/stable-release.yml

@@ -675,6 +675,9 @@ jobs:
             "${args[@]}"
       - name: Set up Docker Buildx for ordered alias promotion
         uses: useblacksmith/setup-docker-builder@19215110ab936351210feebdfa5b440b4493e184  # v2
+        with:
+          # the action's default buildx (v0.23.0) fails to push manifest lists to Docker Hub
+          buildx-version: latest
       - name: Log in to Docker Hub for ordered alias promotion
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with: