ci_test-int: harden Docker install for firmware Docker Hub push

[foil-copy-overrate]

Outcome

Updated .github/workflows/ci_test-int.yml on main to harden the firmware-publish Docker install used before pushing 0mniteck/yubios:firmware.

Commit: e1356ca
Workflow file: .github/workflows/ci_test-int.yml

What changed

• Added a narrow on.push trigger scoped to .github/workflows/ci_test-int.yml so workflow-file edits can validate themselves on main.
• Changed the firmware-publish Docker setup from copying static Docker binaries over /usr/bin to a private install under ${RUNNER_TEMP}/docker-static/bin.
• Installed Buildx under $HOME/.docker/cli-plugins and exported the private Docker binary path through $GITHUB_PATH.
• Started the private dockerd with an explicit PATH, preserving access to the bundled static containerd/support binaries.

Likely root cause

The publish job runs on a bare ubuntu-24.04 runner, unlike the containerized image build jobs. Copying static Docker binaries into /usr/bin can collide with the runner's preinstalled/running Docker stack during the Docker Hub push path. The private install avoids mutating host Docker binaries while still using the workflow's pinned Docker/Buildx versions.

Validation state

• Re-fetched the committed diff and confirmed only the workflow trigger and firmware-publish Docker install block changed.
• PINNED.md still covers the existing pinned action refs and container image policy; no new actions or images were introduced.
• GitHub combined status for the commit did not expose a check result at report time.
• The new push trigger should validate workflow syntax and non-push paths, but the Docker Hub publish path still requires workflow_dispatch with Docker_push=true because firmware-publish is intentionally gated on that input.

Next step

Dispatch ci_test-int.yml on main with Docker_push=true to exercise the firmware Docker Hub publish path end to end.