fix(ci): pin buildx by version so the Docker manifest jobs stop falling back to v0.23.0

useblacksmith/setup-docker-builder accepts only 'latest' or vX.Y.Z for
buildx-version. cf4f3a7396 replaced the version with a commit SHA, which the
action rejects ("Invalid buildx-version ... Falling back to default v0.23.0"),
so every job 50bab3867d moved to a current buildx was back on v0.23.0, whose
`imagetools create` cannot publish a manifest list to Docker Hub (404 on the
index commit). Stable v0.22.3 rc.3 failed "Assemble versioned manifest and
digest receipt" 3/3 that way.

Pin v0.38.1 (the release the SHA's own comment names, with the CVE fix the
SHA pin was after). The action still verifies the downloaded binary.

.github/workflows/docker.yml

@@ -473,14 +473,14 @@ jobs:
         uses: useblacksmith/setup-docker-builder@19215110ab936351210feebdfa5b440b4493e184  # v2
         with:
           # the action's default buildx (v0.23.0) fails to push manifest lists to Docker Hub
-          buildx-version: 0dbe87f36ed472fe36b6796c3f70b4210a731fc5 # v0.38.1
+          buildx-version: v0.38.1  # a version string: the action rejects a commit SHA and falls back to v0.23.0
 
       - name: Set up Docker Buildx (retry)
         if: steps.buildx.outcome == 'failure'
         uses: useblacksmith/setup-docker-builder@19215110ab936351210feebdfa5b440b4493e184  # v2
         with:
           # the action's default buildx (v0.23.0) fails to push manifest lists to Docker Hub
-          buildx-version: 0dbe87f36ed472fe36b6796c3f70b4210a731fc5 # v0.38.1
+          buildx-version: v0.38.1  # a version string: the action rejects a commit SHA and falls back to v0.23.0
 
       - name: Log in to Docker Hub
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
@@ -659,14 +659,14 @@ jobs:
         uses: useblacksmith/setup-docker-builder@19215110ab936351210feebdfa5b440b4493e184  # v2
         with:
           # the action's default buildx (v0.23.0) fails to push manifest lists to Docker Hub
-          buildx-version: 0dbe87f36ed472fe36b6796c3f70b4210a731fc5 # v0.38.1
+          buildx-version: v0.38.1  # a version string: the action rejects a commit SHA and falls back to v0.23.0
 
       - name: Set up Docker Buildx (retry)
         if: steps.buildx.outcome == 'failure'
         uses: useblacksmith/setup-docker-builder@19215110ab936351210feebdfa5b440b4493e184  # v2
         with:
           # the action's default buildx (v0.23.0) fails to push manifest lists to Docker Hub
-          buildx-version: 0dbe87f36ed472fe36b6796c3f70b4210a731fc5 # v0.38.1
+          buildx-version: v0.38.1  # a version string: the action rejects a commit SHA and falls back to v0.23.0
 
       - name: Log in to Docker Hub
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0

.github/workflows/sandbox-image.yml

@@ -145,7 +145,7 @@ jobs:
         uses: useblacksmith/setup-docker-builder@19215110ab936351210feebdfa5b440b4493e184  # v2
         with:
           # the action's default buildx (v0.23.0) fails to push manifest lists to Docker Hub
-          buildx-version: 0dbe87f36ed472fe36b6796c3f70b4210a731fc5 # v0.38.1
+          buildx-version: v0.38.1  # a version string: the action rejects a commit SHA and falls back to v0.23.0
 
       - name: Log in to Docker Hub
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0

.github/workflows/stable-release-publication.yml

@@ -50,7 +50,7 @@ jobs:
         uses: useblacksmith/setup-docker-builder@19215110ab936351210feebdfa5b440b4493e184  # v2
         with:
           # the action's default buildx (v0.23.0) fails to push manifest lists to Docker Hub
-          buildx-version: 0dbe87f36ed472fe36b6796c3f70b4210a731fc5 # v0.38.1
+          buildx-version: v0.38.1  # a version string: the action rejects a commit SHA and falls back to v0.23.0
       - name: Log in to Docker Hub for ordered alias promotion
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:

.github/workflows/stable-release.yml

@@ -677,7 +677,7 @@ jobs:
         uses: useblacksmith/setup-docker-builder@19215110ab936351210feebdfa5b440b4493e184  # v2
         with:
           # the action's default buildx (v0.23.0) fails to push manifest lists to Docker Hub
-          buildx-version: 0dbe87f36ed472fe36b6796c3f70b4210a731fc5 # v0.38.1
+          buildx-version: v0.38.1  # a version string: the action rejects a commit SHA and falls back to v0.23.0
       - name: Log in to Docker Hub for ordered alias promotion
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with: