b715a5dffb
--secret requires BuildKit; DOCKER_BUILDKIT=1 enables it on the legacy Docker client. Also add GITHUB_SHA fallback and git rev-parse last-resort so the image tag is never empty.