feat: build and publish multi-arch Docker images
## Description
The `docker_build` job does not specify a `--platform` flag, meaning the
image architecture silently depends on whichever runner picks up the job.
On an ARM runner this produces an ARM image tagged and published as the
release image, breaking amd64 users pulling `latest`. Building an explicit
multi-arch manifest ensures the image runs correctly on both amd64 and
arm64 hosts.
## Acceptance Criteria
- `docker_build` uses Docker Buildx to produce a multi-arch manifest
covering `linux/amd64` and `linux/arm64`.
- The published image runs correctly on both amd64 and arm64 hosts.
- The `--platform` flag (or equivalent buildx setup) is explicit so the
build is never silently architecture-dependent.
## Additional information
The missing `--platform` flag is also a correctness issue in the current
pipeline when community ARM runners are enabled — not just a missing
feature. Fixing this is a prerequisite for safely allowing `docker_build`
to run on ARM runners.
issue