ci: pull the BuildKit frontend from the mirror too

Run #70's logs still showed one Docker Hub reference, from the one place
that does not look like an image reference:

  #2 resolve image config for docker-image://docker.io/docker/dockerfile:1.10

`# syntax=` is an image pull. Same mirror, same digest, and pinned now —
it was the only unpinned image left in the build.

services/reconciler/Dockerfile

@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile:1.10
+# syntax=mirror.gcr.io/docker/dockerfile:1.10@sha256:865e5dd094beca432e8c0a1d5e1c465db5f998dca4e439981029b3b81fb39ed5
 #
 # svcforge reconciler. Build from the REPO ROOT:
 #     docker buildx build -f services/reconciler/Dockerfile -t svcforge/reconciler:dev .

services/worker/Dockerfile

@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile:1.10
+# syntax=mirror.gcr.io/docker/dockerfile:1.10@sha256:865e5dd094beca432e8c0a1d5e1c465db5f998dca4e439981029b3b81fb39ed5
 #
 # svcforge worker. Build from the REPO ROOT:
 #     docker buildx build -f services/worker/Dockerfile -t svcforge/worker:dev .