feat: use dind:${INTERNAL_TAG} during build

This builds dind with the default dind, then tests that dind can build inside the new dind and publishes if it succeeds. That guarantees hopefully that we only publish working dind images for future use.