ci(docker): publish multi-architecture images

[neobuilds]

Summary

• build release images in parallel on native AMD64 and ARM64 GitHub-hosted runners
• push each platform image by digest, then merge the digests into the existing semver, minor, and latest tags
• preserve the existing image job output consumed by the release-bundle job
• document the multi-architecture release boundary without retroactively describing old tags as ARM64-compatible
• announce native ARM64 image support in the in-progress 0.0.17 changelog
• add a focused regression test for the native-runner and manifest-merge contract

Why

Instatic originally configured QEMU-based AMD64 + ARM64 publishing, then intentionally limited releases to AMD64 in b8dda9ac because emulated ARM64 publishing made the tagged workflow too slow.

This version follows the repository's stated intended fix: each architecture builds on a separate native GitHub-hosted runner (ubuntu-latest and ubuntu-24.04-arm). The final job merges the platform digests into one OCI image index, so the release gate does not run the application build under QEMU.

Verification

• actionlint .github/workflows/release.yml — passed
• YAML dependency/matrix assertions — passed (verify → native matrix → manifest → bundle)
• focused Docker/release tests — 11 passed, 0 failed
• bun run lint — passed
• AMD64 runtime: SQLite, Sharp PNG encoding, esbuild transform, non-root user, and /health passed
• ARM64 runtime under QEMU: SQLite, Sharp PNG encoding, esbuild transform, non-root user, and /health passed
• local-registry digest merge produced one OCI index containing linux/amd64 and linux/arm64
• git diff --check — passed

The earlier full suite run completed 6,667 tests. Its Docker literal assertion was updated and now passes. The unrelated circular-dependency test exceeded its fixed 15-second wrapper timeout; its underlying command passed directly in 16.2 seconds.

Review note

This remains a draft in the fork. No upstream pull request or release has been created. The tag-triggered GHCR publication cannot be exercised end to end from the fork because the workflow intentionally publishes to the upstream corebunch package namespace.