chore: update CI configuration to disable filesystem entitlement for Docker builds

Added the BUILDX_BAKE_ENTITLEMENTS_FS environment variable set to "0" in the CI workflow to allow Docker builds to read the repository context. Updated the README to clarify this change and provide guidance on local usage for similar issues.

.gitea/workflows/ci.yaml

@@ -225,6 +225,8 @@ jobs:
           SHA_FULL: ${{ github.sha }}
           CACHE_REF_GO: git.shts.su/${{ steps.meta.outputs.owner_lc }}/evobgp-buildcache:go-buildcache
           CACHE_REF_WEB: ""
+          # buildx bake: context ../.. (корень репо) — на доверенном CI отключаем fs entitlement gate
+          BUILDX_BAKE_ENTITLEMENTS_FS: "0"
         run: |
           set -euxo pipefail
           cd "${{ github.workspace }}/deploy/docker"
@@ -267,6 +269,7 @@ jobs:
           SHA_FULL: ${{ github.sha }}
           CACHE_REF_GO: ""
           CACHE_REF_WEB: git.shts.su/${{ steps.meta.outputs.owner_lc }}/evobgp-buildcache:web-buildcache
+          BUILDX_BAKE_ENTITLEMENTS_FS: "0"
         run: |
           set -euxo pipefail
           cd "${{ github.workspace }}/deploy/docker"
@@ -310,6 +313,7 @@ jobs:
           SHA_FULL: ${{ github.sha }}
           CACHE_REF_GO: ""
           CACHE_REF_WEB: ""
+          BUILDX_BAKE_ENTITLEMENTS_FS: "0"
         run: |
           set -euxo pipefail
           cd "${{ github.workspace }}/deploy/docker"