ci: use corp docker-cli-buildx image and dind 29.1.2

Switch to the working pattern provided by infra team:
- image: repo.nstart.cloud/nstart/docker-cli-buildx:1.0.0 (corp-built
  client with proper Harbor credentials baked in / runner-friendly)
- service: docker:29.1.2-dind (matches runner-tested version)
- explicit --tls=false + DOCKER_HOST=tcp://docker:2375 + DOCKER_TLS_CERTDIR=''
The earlier docker:26 + custom TLS attempts hit shared-volume issues
specific to this runner setup.

.gitlab-ci.yml

@@ -62,15 +62,14 @@ maven-package:
 # ─── PUBLISH (Docker images) ───────────────────
 .docker_base:
   stage: publish
-  image: repo.nstart.cloud/library/docker:26
+  image: repo.nstart.cloud/nstart/docker-cli-buildx:1.0.0
   services:
-    - name: repo.nstart.cloud/library/docker:26-dind
+    - name: repo.nstart.cloud/library/docker:29.1.2-dind
       alias: docker
+      command: ["--tls=false"]
   variables:
-    DOCKER_HOST: tcp://docker:2376
-    DOCKER_TLS_CERTDIR: /certs
-    DOCKER_TLS_VERIFY: "1"
-    DOCKER_CERT_PATH: /certs/client
+    DOCKER_HOST: tcp://docker:2375
+    DOCKER_TLS_CERTDIR: ""
     DOCKER_BUILDKIT: "1"
 
 # Build & push в repo.nstart.cloud (corp Harbor) — единый registry для всех окружений.