docker: fail the image build when the containerd store is disabled (#2753)

build.sh builds several images as multi-platform (amd64 + arm64) with
buildx --load, which only retains both platforms when Docker uses the
containerd image store. On a classic-store machine, --load silently
keeps just the host-native platform, and push.sh then replaces the
multi-arch tag in gcr.io with a single-arch manifest.

This is what happened to gcr.io/bazel-public/ubuntu2404 after the
2026-07-31 rebuild (#2748, #2750): the tag currently serves a plain
amd64 manifest with no manifest list, and every ubuntu2404_arm64 BCR
presubmit job since then dies before bcr_presubmit.py runs.

The script already acknowledged the requirement with a comment and a
docker info printout, but nothing enforced it. This turns the printout
into a hard failure so an incomplete image set can't be built, and
therefore can't be pushed.

The broken tag itself still needs a rebuild + re-push from a
containerd-store machine, but this prevents the next occurrence.