feat(builds): run builds on a remote builder #405

Problem

Images build on the host's Docker Engine: build_image runs docker buildx build --builder=default against the local socket (apps/piqueld/src/docker/resources.rs). A host with little CPU, memory or disk has no way to hand the build to a larger machine.

Proposed solution

Configuration. A [build] section in config.toml, the NixOS module and the configuration reference. Without it, builds run on the host as today.

[build]
# The build machine's BuildKit daemon.
builder = "tcp://build.example.ts.net:1234"
# The registry it pushes to, and the host pulls from.
registry = "build.example.ts.net:5000"

Builder. At startup piqueld registers the builder with Buildx's remote driver, in a Buildx configuration directory of its own under the data directory, so nothing depends on the daemon user's Docker configuration.

Build. The host checks the repository out as today, then runs the build on the builder:

• for the platform of the host's engine (--platform), since the build machine may have another architecture;
• pushed to <registry>/<application>/<service>, with the ownership labels images carry today;
• then pulled by the digest the build reports, like an image source.

Identity. A Git source built this way resolves to a repository digest instead of a local image ID. ImmutableImage and image cleanup already cover both; the build records, the API, piquelctl and the dashboard show the digest.

To settle first

• Transport. Docker documents the remote driver over TCP (with mTLS) and over Unix sockets, not over ssh://. Candidates: TCP on the tailnet, limited by tailnet access rules, with or without mTLS; or a Unix socket forwarded over SSH. Prove one end to end before the rest.
• Registry outage. Check that Swarm starts a digest-pinned service from the local image while the registry is unreachable.

Out of scope

Several builders, choosing a builder per application, and running more than one build at a time.

Depends on #404, whose build identity it extends. Part of #403.

Written with Claude Fable 5.2 in Claude Code (via T3 Code).