feat(local): just rebuild — TF_VAR secrets, live progress, builder docs

- Accept TF_VAR_-prefixed B2 keys (from direnv); make GITHUB_PAT optional.
- Stream the remote build with --progress=plain.
- Document creating the artemis/gaia buildx builders with the docker-container
  driver (the default remote driver does not work with an ssh:// docker host).

justfile

@@ -7,9 +7,11 @@
 # refreshed so the result is immediately servable.
 #
 # Prerequisites:
-#   - buildx builders named `artemis` (amd64) and `gaia` (arm64), e.g.
-#       docker buildx create --name artemis --node artemis ssh://<host-amd64>
-#       docker buildx create --name gaia    --node gaia    ssh://<host-arm64>
+#   - buildx builders named `artemis` (amd64) and `gaia` (arm64), created with the
+#     docker-container driver (runs BuildKit on the remote host's docker daemon over
+#     SSH). The default `remote` driver does NOT work with an ssh:// docker host.
+#       docker buildx create --name artemis --driver docker-container ssh://<user@host-amd64>
+#       docker buildx create --name gaia    --driver docker-container ssh://<user@host-arm64>
 #   - exported secrets: B2_S3_ACCESS_KEY, B2_S3_SECRET_KEY, PGPASS (GITHUB_PAT optional)
 #
 # Overridable (env or `just VAR=… rebuild …`):
@@ -58,6 +60,7 @@ rebuild os tag arch package *versions:
       --builder "$builder" \
       --platform "linux/{{ arch }}" \
       --no-cache \
+      --progress=plain \
       --output type=cacheonly \
       "${secret_args[@]}" \
       --build-arg OS="{{ os }}" \