ci: bypass Docker Hub for tonistiigi/binfmt in Prepare Buildx

The build agent cannot reach auth.docker.io from behind the local network,
causing 'docker run tonistiigi/binfmt --install arm64' to fail with a token
fetch timeout.

Fix: three-tier fallback for ARM64 binfmt registration:
  1. Skip if /proc/sys/fs/binfmt_misc/qemu-aarch64 already exists.
  2. Pull tonistiigi/binfmt via docker.m.daocloud.io mirror.
  3. Fall back to qemu-user-static via apt.

Add a post-registration sanity check (arm64 alpine + uname -m) so
misconfigured builders fail fast rather than at buildx invocation time.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Jenkinsfile

@@ -55,7 +55,23 @@ pipeline {
                 sh """
                     set -e
                     sudo docker buildx version
-                    sudo docker run --privileged --rm tonistiigi/binfmt --install arm64
+
+                    # Register ARM64 binfmt. Docker Hub is unreachable from this builder,
+                    # so try daocloud mirror first; fall back to apt-installed qemu-user-static.
+                    if [ ! -e /proc/sys/fs/binfmt_misc/qemu-aarch64 ] && [ ! -e /proc/sys/fs/binfmt_misc/qemu-aarch64-static ]; then
+                      echo 'Registering ARM64 emulation (binfmt not present)...'
+                      if ! sudo docker run --privileged --rm docker.m.daocloud.io/tonistiigi/binfmt --install arm64 2>/dev/null; then
+                        echo 'daocloud mirror failed, falling back to qemu-user-static via apt...'
+                        sudo apt-get update -qq
+                        sudo apt-get install -y -qq qemu-user-static
+                      fi
+                    else
+                      echo 'ARM64 binfmt already registered, skipping.'
+                    fi
+
+                    # Verify emulation works before proceeding
+                    sudo docker run --rm --platform linux/arm64 docker.m.daocloud.io/library/alpine:latest uname -m
+
                     if ! sudo docker buildx inspect --builder ${BUILDER_NAME} >/dev/null 2>&1; then
                       sudo docker buildx create \
                         --name ${BUILDER_NAME} \