fix: add docker-container buildx builder to resolve push-by-digest failures

.github/workflows/devcontainer-prebuild.yaml

@@ -75,6 +75,14 @@ jobs:
         # renovate: datasource=npm depName=@devcontainers/cli
         run: npm install -g @devcontainers/cli@0.87.0
 
+      - name: Set up Docker Buildx
+        # push-by-digest=true (used in the pre-build step) requires the
+        # docker-container driver; the runner default docker driver does not
+        # support it.  Create the builder manually rather than using the
+        # setup-buildx action from docker/ to avoid a separate Docker Hub
+        # authentication round-trip introduced by that action.
+        run: docker buildx create --use --driver docker-container --name devcontainer-builder --bootstrap
+
       - name: Decide whether to push
         id: push
         # Push on main branch and on v* tags for push/dispatch/schedule events.

tests/bash/validate-devcontainer.bats

@@ -87,16 +87,23 @@ setup() {
 	[ "$status" -ne 0 ]
 }
 
-@test "validate-devcontainer: workflow does not bootstrap a containerized Buildx builder" {
+@test "validate-devcontainer: workflow creates buildx builder without setup-buildx-action" {
 	workflow="$REPO_ROOT/.github/workflows/devcontainer-prebuild.yaml"
 
 	[ -f "$workflow" ]
 
-	# The GitHub runners already ship docker buildx with the built-in docker
-	# driver, so avoid setup-buildx-action here: its default docker-container
-	# bootstrap pulls moby/buildkit from Docker Hub and has been flaky.
+	# push-by-digest=true requires the docker-container driver.  We create the
+	# builder manually with `docker buildx create` rather than using
+	# docker/setup-buildx-action to avoid a separate Docker Hub authentication
+	# round-trip introduced by that action.
 	run grep -F 'docker/setup-buildx-action' "$workflow"
 	[ "$status" -ne 0 ]
+
+	run grep -F 'docker buildx create' "$workflow"
+	[ "$status" -eq 0 ]
+
+	run grep -F 'docker-container' "$workflow"
+	[ "$status" -eq 0 ]
 }
 
 @test "validate-devcontainer: prebuild image includes generated package manifest" {