fix(ci): reorder buildx setup before GHCR login in kapinger workflow

[nddq]

Description

Currently, docker login ghcr.io runs before docker/setup-buildx-action in
all kapinger workflow jobs. When buildx bootstraps, it pulls
moby/buildkit:buildx-stable-1 from Docker Hub — but the prior GHCR login
poisons the Docker credential store, causing a 401 against registry-1.docker.io.

This PR reorders all 4 jobs (build-linux, build-windows, manifest,
build-toolbox) to run Set up Docker Buildx before Log in to GHCR, so
buildx can pull its builder image from Docker Hub with no credentials configured.

Failed run: https://github.com/microsoft/retina/actions/runs/23654791759/job/68908997696

Related Issue

N/A

Checklist

• I have read the contributing documentation.
• I signed and signed-off the commits (git commit -S -s ...). See this documentation on signing commits.
• I have correctly attributed the author(s) of the code.
• I have tested the changes locally.
• I have followed the project's style guidelines.
• I have updated the documentation, if necessary. (not applicable — CI-only change)
• I have added tests, if applicable. (not applicable — CI-only change)

Screenshots (if applicable) or Testing Completed

CI will validate — the workflow triggers on PRs that touch .github/workflows/kapinger.yaml.

Additional Notes

N/A

[github-actions]

Retina Code Coverage Report

Total coverage no change