ci: setup-buildx before every cache-exporting image build

First live run of the cache trio failed at flag-parse time: the
default buildx `docker` driver hard-errors on cache-to registry
export ('Cache export is not supported for the docker driver'), which
failed build-image on PR #2593 and skipped the entire gate eval
matrix behind it. docker/setup-buildx-action creates the
docker-container builder that supports registry cache export; all
three build sites (evals, evals-periodic, ci-image) get it.

.github/workflows/ci-image.yml

@@ -37,6 +37,10 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      # Registry cache export needs a docker-container builder — the default
+      # `docker` driver hard-errors on cache-to.
+      - uses: docker/setup-buildx-action@v3
+
       - uses: docker/build-push-action@v6
         with:
           context: .github/docker