Drop the dead dockerd/vfs step — the job container already shares the host's Docker socket

Verified from the actual job container logs: act_runner bind-mounts
/var/run/docker.sock into every job container unconditionally, even before
privileged mode was enabled. The previous step's nested dockerd never
actually got used.

.gitea/workflows/docker-build-push.yml

@@ -11,21 +11,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      # act_runner's job container ships docker+dockerd but doesn't start the
-      # daemon itself. This host's outer Docker uses overlay2, and overlay2
-      # can't nest inside overlay2 (BuildKit mount fails with "invalid
-      # argument"), so the inner daemon has to use vfs instead — slower, no
-      # layer dedup, but the only storage driver that actually works nested
-      # here.
-      - name: Start Docker daemon (vfs storage driver)
-        run: |
-          dockerd --storage-driver=vfs > /tmp/dockerd.log 2>&1 &
-          for i in $(seq 1 30); do
-            docker info >/dev/null 2>&1 && break
-            sleep 1
-          done
-          docker info >/dev/null 2>&1 || { cat /tmp/dockerd.log; exit 1; }
-
+      # act_runner bind-mounts the admin host's real Docker socket into every
+      # job container (Docker-outside-of-Docker, not a nested daemon), so
+      # `docker` here talks straight to the host's daemon — no separate
+      # dockerd to start.
       - name: Build and push image
         env:
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}