build_proxy() authenticates Docker with the Gitea registry, runs `docker buildx build --platform linux/arm64 --push`, then applies manifests and rolls the pingora deployment to pull the fresh image. The Gitea admin password is read from the gitea-admin-credentials K8s Secret (written by VSO) so --build works independently of --seed.