Workflows need docker CLI which is only available in the docker:latest container started by the 'build' runner label, not node:20-bookworm.