Images build in a capped BuildKit builder

A plain `docker buildx build` of ipx on 2026-11-04, its dependency layer
invalidated by a Cargo.toml change (#382), rebuilt everything in release
on all twelve threads with 5 GB free and no swap. Tower thrashed for
three hours with every core pegged and had to be rebooted.

scripts/build-image.sh now builds every image: it refuses under 9 GB
available or above load 12, and builds in the docker-container builder
ipx-capped, held to 6 GB and six threads by its cgroup, so a build that
outgrows that is killed instead of stalling production. The builder
pulls base images through mirror.gcr.io, which replaces tagging local
copies to dodge Docker Hub's 429s. CLAUDE.md deploys only through it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/buildkitd.toml

@@ -0,0 +1,10 @@
+# BuildKit's own config for the capped builder that scripts/build-image.sh makes.
+# The registry on Tower answers plain HTTP.
+[registry."192.168.1.130:5000"]
+  http = true
+  insecure = true
+
+# This builder cannot see the images the Docker daemon has stored, so the base images come
+# from Google's mirror instead of Docker Hub, which rate-limits this host (429).
+[registry."docker.io"]
+  mirrors = ["mirror.gcr.io"]