ci: provision Python venv and proxy BuildKit pulls

Jenkinsfile

@@ -25,7 +25,7 @@ pipeline {
         OPENLIST_BASE_URL = 'https://openlist.nxsir.cn'
         OPENLIST_REMOTE_DIR = '/yidongpan/构建产物/imagefind'
         HTTP_PROXY_URL = 'http://192.168.5.200:7890'
-        NO_PROXY_HOSTS = '127.0.0.1,localhost,reg.nxsir.cn,gitea.nxsir.cn,openlist.nxsir.cn,docker.m.daocloud.io,pypi.tuna.tsinghua.edu.cn'
+        NO_PROXY_HOSTS = '127.0.0.1,localhost,reg.nxsir.cn,gitea.nxsir.cn,openlist.nxsir.cn,pypi.tuna.tsinghua.edu.cn'
         BUILDER_NAME = "imagefind-${BUILD_NUMBER}"
         DOCKER_CONFIG = "${WORKSPACE}/.ci/docker"
         NPM_CONFIG_CACHE = "${WORKSPACE}/.ci/npm-cache"
@@ -63,6 +63,18 @@ pipeline {
                     currentBuild.displayName = "#${env.BUILD_NUMBER} ${env.IMMUTABLE_TAG}"
                     currentBuild.description = "fnOS ${env.FNOS_VERSION}"
                 }
+                withCredentials([usernamePassword(credentialsId: "${NODE_CREDENTIALS}", usernameVariable: 'JENKINS_NODE_USERNAME', passwordVariable: 'JENKINS_NODE_PASSWORD')]) {
+                    sh '''
+                        set -euo pipefail
+                        if ! python3 -c 'import ensurepip' >/dev/null 2>&1; then
+                          printf '%s\n' "$JENKINS_NODE_PASSWORD" | sudo -S -p '' apt-get update
+                          printf '%s\n' "$JENKINS_NODE_PASSWORD" | sudo -S -p '' \
+                            apt-get install -y --no-install-recommends python3.13-venv
+                          printf '%s\n' "$JENKINS_NODE_PASSWORD" | sudo -S -p '' apt-get clean
+                        fi
+                        python3 -c 'import ensurepip'
+                    '''
+                }
                 sh '''
                     set -euo pipefail
                     test "$(uname -m)" = x86_64
@@ -117,7 +129,11 @@ pipeline {
                     sh '''
                         set -euo pipefail
                         ./scripts/ci-docker.sh buildx rm -f "$BUILDER_NAME" >/dev/null 2>&1 || true
-                        ./scripts/ci-docker.sh buildx create --name "$BUILDER_NAME" --driver docker-container --driver-opt network=host --use
+                        ./scripts/ci-docker.sh buildx create --name "$BUILDER_NAME" --driver docker-container \
+                          --driver-opt network=host \
+                          --driver-opt "env.http_proxy=$HTTP_PROXY_URL" \
+                          --driver-opt "env.https_proxy=$HTTP_PROXY_URL" \
+                          --driver-opt "env.no_proxy=$NO_PROXY_HOSTS" --use
                         ./scripts/ci-docker.sh buildx inspect "$BUILDER_NAME" --bootstrap
                         ./scripts/ci-docker.sh buildx build --builder "$BUILDER_NAME" --platform linux/amd64 --network host \
                           --progress=plain --provenance=false --no-cache --load \