randall/frontend and randall/backend were being resolved as docker.io
paths, causing unwanted registry auth attempts. The localhost/ prefix
marks them as local-only images. Also restores docker/setup-buildx-action
with the docker driver, and reverts the ECR Public mirror workaround
since it was never the root cause.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>