ci: run buildx sandboxes on the host network

[brunomenezes]

Summary

Makes the cli and release workflows run the Buildx builder and its RUN sandboxes on the runner's network. Since 2026-10-12 some GitHub-hosted ubuntu-24.04 runners carry an egress-proxy experiment (actions/runner-images#14925). On those runners, DNS inside the nested BuildKit sandbox fails intermittently, and every cartesi build in the integration tests dies in apt-get update with Could not resolve 'ports.ubuntu.com'. The identical commit passes on runners without the experiment. Nothing in the CLI or the test Dockerfiles changed.

How it works

Today, apt's DNS query from a RUN step crosses three network layers and never touches the runner's resolver:

RUN sandbox (CNI bridge, resolv.conf stripped of loopback)
  → builder container (docker bridge, Docker-rewritten resolv.conf)   NAT
  → runner VM                                                         NAT
  → external resolver over UDP                                        ✖ fails on experiment runners

With this change, both layers collapse into the runner's network namespace, and BuildKit hands the sandbox the host's /etc/resolv.conf unchanged:

RUN sandbox = builder container = runner VM
  → systemd-resolved on 127.0.0.53                                    ✔ same path as bun install and docker pull

Changes

• docker/setup-buildx-action in cli.yaml and release.yaml gains driver-opts: network=host, which runs the builder container on the host network, and --oci-worker-net=host in buildkitd-flags, which runs every RUN step in that same namespace.
• buildkitd-flags restates the action's two default entitlements (security.insecure, network.host), since setting the input replaces them.

Notes

• Evidence from the release PR run: three attempts on Hosted Compute Agent 20261012.601 (westus3) failed in the Test step, one on 20261002.596 (eastus) passed, same commit and workflow. The runner image also moved (20261004.327 → 20261012.334), but its release notes show only tool bumps, no Docker or kernel change.
• GitHub says the experiment is live and resumed; there is no public fix for container DNS. This change stays valid after the experiment ends.
• RUN steps now share the runner's network, so a Dockerfile that binds a port during a build would bind it on the runner. None of the test Dockerfiles do. Build outputs are unaffected.
• Not testable locally. The CI run of this PR is the check: if its "Set up job" step shows agent 20261012.601 and the tests pass, the fix is confirmed; on 20261002.596 the run is green but inconclusive.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 0f79f7d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🟢	Lines	90.29% (🎯 0%)	12168 / 13477
🔵	Statements	90.29%	12168 / 13477
🔵	Functions	77.95%	258 / 331
🔵	Branches	0%	0 / 0

📁 File Coverage (20 files)

File	Lines	Statements	Functions	Branches	Uncovered Lines
apps/cli/src/base.ts	🔴 29.44%	🔴 29.44%	🔴 33.33%	🔴 0%	39, 46-50, 61-71, 75-84, 88...
apps/cli/src/builder/directory.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
apps/cli/src/builder/docker.ts	🟢 86.72%	🟢 86.72%	🟡 66.67%	🔴 0%	75-77, 79, 109-111, 169-178
apps/cli/src/builder/empty.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
apps/cli/src/builder/none.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
apps/cli/src/builder/nvram.ts	🟢 96.88%	🟢 96.88%	🟢 100%	🔴 0%	27
apps/cli/src/builder/tar.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
apps/cli/src/commands/foreclose.ts	🔴 49.09%	🔴 49.09%	🔴 50%	🔴 0%	69, 91-145
apps/cli/src/commands/refund.ts	🔴 38.2%	🔴 38.2%	🟡 66.67%	🔴 0%	55-109
apps/cli/src/commands/withdraw.ts	🔴 46.58%	🔴 46.58%	🟡 73.33%	🔴 0%	95-123, 277-278, 301-356, 3...
apps/cli/src/compose/anvil.ts	🟡 79.25%	🟡 79.25%	🟢 100%	🔴 0%	19-29
apps/cli/src/compose/builder.ts	🟢 99.79%	🟢 99.79%	🟢 100%	🔴 0%	228
apps/cli/src/compose/bundler.ts	🔴 4.82%	🔴 4.82%	🔴 0%	🔴 0%	8-40, 44-75, 79-92
apps/cli/src/compose/common.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
apps/cli/src/compose/database.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
apps/cli/src/compose/explorer.ts	🔴 6.67%	🔴 6.67%	🔴 0%	🔴 0%	10-38, 43-55, 59-72
apps/cli/src/compose/node.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
apps/cli/src/compose/passkey.ts	🔴 8.33%	🔴 8.33%	🔴 0%	🔴 0%	9-18, 23-42, 46-59
apps/cli/src/compose/paymaster.ts	🔴 7.69%	🔴 7.69%	🔴 0%	🔴 0%	8-21, 25-44, 48-61
apps/cli/src/compose/proxy.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-