release.sh: correct the build prerequisites (builds are remote, not docker-local)

I had it wrong: `cloudron builder build` uploads the build context and the
registry app's BuildKit builds it — the caller needs no docker, only a registry
login. The guard now checks for that login and prints both bootstrap routes
(narrow app password scoped to the registry app, or the CLI device flow) instead
of blaming a missing docker binary.

README.md

@@ -119,10 +119,12 @@ cloudron --server my.inference.coop --token "$CLOUDRON_TOKEN" update \
 
 `./release.sh release` runs this same sequence with both traps handled — it
 refuses to build from a dirty tree, always passes `--no-cache`, writes the tag
-into the manifest before deploying, then runs the verification block. `build`
-needs docker, so it runs on whoever's machine has it (deliberately not the agent
-VM); `verify`, `volume` and `pin`/`deploy` need only `CLOUDRON_TOKEN`.
-`./release.sh verify` is safe to run any time.
+into the manifest before deploying, then runs the verification block. Builds are
+remote (the registry's BuildKit does the work), so the only requirement is a
+registry login on the host running the command; `verify`, `volume` and
+`pin`/`deploy` need only `CLOUDRON_TOKEN`. `./release.sh verify` is safe to run
+any time. If `build` reports no registry login, it prints both ways to bootstrap
+one (a narrow app password scoped to the registry app, or the CLI device flow).
 
 Rollback: repoint `CloudronManifest.json.dockerImage` to the previous tag
 (every build is tagged `20261019-<git-sha>`; the base image