ci(workflow): CI does not use Docker Buildx or GHA cache; every run pulls base image from registry

gh issue create --title "ci(workflow): CI does not use Docker Buildx or GHA cache; every run pulls base image from registry" --label "ci,audit,priority:medium" --body "## Finding

ci.yml runs `docker build` directly (no Buildx). The base image (alpine@sha256:…) is pulled from the registry on every run. CI runs 2-3 minutes slower than necessary; the apk-add layer is re-fetched every run.

## Affected code

- .github/workflows/ci.yml — build step

## Reproduction

1. Inspect ci.yml — `docker build` direct, no `--cache-from`, no `cache-to: type=gha`.
2. Time a CI run; observe network time for the base image + apk add.

## Suggested fix

Add Buildx setup:

- uses: docker/setup-buildx-action@v3
with:
driver-opts: image=moby/buildkit:v0.13.0

Then `docker buildx build --cache-from type=gha --cache-to type=gha,mode=max ...`.

## Source

F2 audit 2026-09-03 (workflows audit). Reporter: subagent-pekodbj7.

## Related

- Part of EPIC #[epic-number]
- Closes: #NONE (no existing issue)
- Related: #156 (BuildKit / Buildx requirements)"