[stirby]

Pins envbuilder to coder/envbuilder#535 (9e64f32) and mirrors its kaniko replace (coder/kaniko#38, 61a5b7da). This drops docker/docker and the chrismellard ACR helper from the provider's reachable code and bumps buildkit to v0.31.2.

Generated by Coder Agents on behalf of @stirby.

Stacked on #137. Merge order: coder/kaniko#38, then coder/envbuilder#535, then #137, then this PR. After the upstream PRs merge, this PR needs a re-pin to their merge commits.

Test template on dogfood: https://dogfood.cdr.dev/templates/coder/kirby-envbuilder-rollup

Advisories

govulncheck ./... (reachable):

• chore: bump envbuilder to the security rollup #137 head: 8 findings. GO-2026-4858, 4859 and 6255 (buildkit), 4883 and 4887 (docker/docker), 6253 (go-archive), 6225 (chrismellard), 6443 (grpc).
• This branch: 1 finding, GO-2026-6443 (grpc). grpc is intentionally left alone.

kaniko, buildkit, go-containerregistry (v0.21.7), go-archive, docker/cli, grpc and x/crypto resolve to the same versions as envbuilder#535.

Validation

• go build, golangci-lint run (v1.64.8) and go generate ./... (no diff) pass.
• make test-registry + TF_ACC=1 go test -cover ./internal/provider/ passes. That includes TestAccCachedImageResource with its multistage_run_copy case (87.1% coverage).

See envbuilder#535 for the behavior changes this pulls in. The ones that matter to cache probing are *.local registries no longer falling back to plain HTTP, and slower registry retries.