修复 CI 镜像脚本的 Buildx 驱动检查兼容性

读取 buildx inspect 的 Driver 字段，移除不受支持的 --format 参数。
收紧 Docker 测试替身参数检查，并覆盖错误驱动拒绝行为。
更新部署文档与共享记忆，记录真实 Buildx 兼容性验证要求。

scripts/gitea-ci-job-image.sh

@@ -18,7 +18,7 @@ prepare_builder() {
       --driver-opt image=moby/buildkit:v0.23.2@sha256:ddd1ca44b21eda906e81ab14a3d467fa6c39cd73b9a39df1196210edcb8db59e \
       --buildkitd-config "${repo_root}/deploy/container/gitea-ci-buildkitd.toml"
   fi
-  if [[ "$(docker buildx inspect "${builder_name}" --format '{{.Driver}}')" != docker-container ]]; then
+  if [[ "$(docker buildx inspect "${builder_name}" | awk '$1 == "Driver:" { print $2 }')" != docker-container ]]; then
     echo "${builder_name} must use the isolated docker-container driver" >&2
     return 1
   fi

scripts/test_gitea_cache_image_context.py

@@ -90,7 +90,8 @@ class GiteaCiImageContextTest(unittest.TestCase):
             set -eu
             if [[ "$1" == buildx && "$2" == version ]]; then exit 0; fi
             if [[ "$1" == buildx && "$2" == inspect ]]; then
-              if [[ " $* " == *" --format "* ]]; then printf 'docker-container\\n'; fi
+              if [[ "$#" != 3 ]]; then echo 'unsupported buildx inspect arguments' >&2; exit 2; fi
+              printf 'Name: genarrative-ci-images\\nDriver: %s\\n' "${FAKE_BUILDX_DRIVER:-docker-container}"
               exit 0
             fi
             if [[ "$1" == buildx && "$2" == build ]]; then
@@ -108,8 +109,10 @@ class GiteaCiImageContextTest(unittest.TestCase):
         ).encode("utf-8"))
         docker.chmod(docker.stat().st_mode | stat.S_IXUSR)
 
-    def run_script(self, script: Path, *arguments: str, capture_context: bool = False) -> subprocess.CompletedProcess[str]:
+    def run_script(self, script: Path, *arguments: str, capture_context: bool = False,
+                   builder_driver: str = "docker-container") -> subprocess.CompletedProcess[str]:
         exports = [f"export PATH={shlex.quote(self.execution_bin)}:\"$PATH\""]
+        exports.append(f"export FAKE_BUILDX_DRIVER={shlex.quote(builder_driver)}")
         if capture_context:
             exports.append(f"export TAR_CAPTURE={shlex.quote(self.wsl_path(self.context_archive))}")
         command = "; ".join(exports) + "; cd /; exec bash " + shlex.quote(self.wsl_path(script))
@@ -129,6 +132,12 @@ class GiteaCiImageContextTest(unittest.TestCase):
                         yield dependency["path"]
             yield from GiteaCiImageContextTest.dependency_paths(child)
 
+    def test_build_rejects_a_builder_with_the_wrong_driver(self) -> None:
+        result = self.run_script(IMAGE_SCRIPT, "build", capture_context=True, builder_driver="docker")
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn("must use the isolated docker-container driver", result.stderr)
+        self.assertFalse(self.context_archive.exists())
+
     def test_build_context_contains_all_local_dependency_manifests_and_no_source(self) -> None:
         result = self.run_script(IMAGE_SCRIPT, "build", capture_context=True)
         self.assertEqual(result.returncode, 0, result.stderr)