- Install Docker 27.5.1 static binary + compose v2 plugin instead
of ancient docker.io from apt (API 1.41 vs required 1.44)
- Read current GITEA_TOKEN from .env before rotation so the API
call to change_admin_password uses a valid token, not the derived
placeholder hash
- Set DOCKER_HOST for the static binary