fix(ci): enable DOCKER_BUILDKIT and fix SHA extraction in deploy

--secret requires BuildKit; DOCKER_BUILDKIT=1 enables it on the legacy
Docker client. Also add GITHUB_SHA fallback and git rev-parse last-resort
so the image tag is never empty.

.gitea/workflows/deploy-gke.yaml

@@ -56,7 +56,14 @@ jobs:
       - name: Determine image tag and slot
         id: vars
         run: |
-          SHA="${GITEA_SHA:0:8}"
+          # GITEA_SHA is set by the Gitea runner; fall back to GITHUB_SHA for
+          # compatibility with older Forgejo/Gitea versions.
+          RAW_SHA="${GITEA_SHA:-${GITHUB_SHA:-}}"
+          SHA="${RAW_SHA:0:8}"
+          if [ -z "$SHA" ]; then
+            # Last resort: read from git directly
+            SHA=$(git rev-parse --short=8 HEAD 2>/dev/null || echo "unknown")
+          fi
           IMAGE="us-central1-docker.pkg.dev/neuron-785695/neuron-api/neuron-soul:${SHA}"
           echo "sha=${SHA}" >> "$GITEA_OUTPUT"
           echo "image=${IMAGE}" >> "$GITEA_OUTPUT"
@@ -100,6 +107,7 @@ jobs:
       - name: Build and push Docker image
         env:
           GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
+          DOCKER_BUILDKIT: "1"
         run: |
           IMAGE="${{ steps.vars.outputs.image }}"
           SHA="${{ steps.vars.outputs.sha }}"