feat: build and publish multi-arch Docker images

Description

The docker_build job does not specify a --platform flag, meaning the image architecture silently depends on whichever runner picks up the job. On an ARM runner this produces an ARM image tagged and published as the release image, breaking amd64 users pulling latest. Building an explicit multi-arch manifest ensures the image runs correctly on both amd64 and arm64 hosts.

Acceptance Criteria

• docker_build uses Docker Buildx to produce a multi-arch manifest covering linux/amd64 and linux/arm64.
• The published image runs correctly on both amd64 and arm64 hosts.
• The --platform flag (or equivalent buildx setup) is explicit so the build is never silently architecture-dependent.

Additional information

The missing --platform flag is also a correctness issue in the current pipeline when community ARM runners are enabled — not just a missing feature. Fixing this is a prerequisite for safely allowing docker_build to run on ARM runners.