ci: switch DinD to TLS mode (standard GitLab pattern)

Non-TLS DinD on tcp://docker:2375 had a race where docker login succeeded
but the next command got 'Cannot connect to the Docker daemon'. Switch
to the documented TLS pattern with DOCKER_TLS_CERTDIR=/certs and
DOCKER_HOST=tcp://docker:2376 — both client and DinD share /certs via
the implicit volume.

.gitlab-ci.yml

@@ -66,10 +66,11 @@ maven-package:
   services:
     - name: repo.nstart.cloud/library/docker:26-dind
       alias: docker
-      command: ["--tls=false"]
   variables:
-    DOCKER_HOST: tcp://docker:2375
-    DOCKER_TLS_CERTDIR: ""
+    DOCKER_HOST: tcp://docker:2376
+    DOCKER_TLS_CERTDIR: /certs
+    DOCKER_TLS_VERIFY: "1"
+    DOCKER_CERT_PATH: /certs/client
     DOCKER_BUILDKIT: "1"
 
 # Build & push в repo.nstart.cloud (corp Harbor) — единый registry для всех окружений.