0.5.3 - CI model download rate limit fix

CI fix for the image build. No application code, dependency pin, or CUDA change.

• The Dockerfile's mfa model download step resolves models through the GitHub releases API. Unauthenticated calls from the shared GitHub Actions runner pool exceed the 60 per hour limit, which is why the 0.5.1 and 0.5.2 release builds failed at that layer while builds on the GPU host succeed.
• The workflow now passes its own GITHUB_TOKEN to the build as a BuildKit secret mount, and the Dockerfile adds --github_token only when that secret is present. Local builds run unauthenticated exactly as before. Secret mounts are not image layers, so the token never lands in the image or its history.
• runDocker.sh exports DOCKER_BUILDKIT=1 defensively.

Validated on the GPU host against the reference file before release.