CI: Require dind tag on Docker image build jobs

Add the 'dind' tag to .build:docker:linux:amd64, .build:docker:linux:arm64, and .build:docker:linux:riscv64.

This ensures Docker image builds only run on privileged runners that support Docker-in-Docker (our dedicated GCP Spot builders), preventing unprivileged community runners and standard GitLab SaaS runners from claiming and failing these jobs.

ci/images.gitlab-ci.yml

diff --git a/ci/images.gitlab-ci.yml b/ci/images.gitlab-ci.yml
index f60c608..682ee90 100644
--- a/ci/images.gitlab-ci.yml
+++ b/ci/images.gitlab-ci.yml
@@ -24,16 +24,19 @@
   extends: .build:docker
   tags:
     - saas-linux-small-amd64
+    - dind
 
 .build:docker:linux:arm64:
   extends: .build:docker
   tags:
     - saas-linux-small-arm64
+    - dind
 
 .build:docker:linux:riscv64:
   extends: .build:docker
   tags:
     - saas-linux-small-amd64
+    - dind
 
 build:docker:ubuntu-24.04-amd64-smoketest-build:
   extends: .build:docker:linux:amd64