ci: publish native AMD64 and ARM64 container manifests

[fl0rianr]

Summary

Publishes AMD64 and ARM64 container images through independent native builds and combines them into a multi-architecture manifest only after both images pass architecture, CLI, and server health checks.

Safety

• Architecture jobs push only digest-addressable images.
• Public tags are created only after both architecture builds and smoke tests pass.
• edge and latest are updated only from a verified multi-architecture manifest.
• A failed AMD64 or ARM64 build leaves the existing public tags unchanged.
• The existing trigger and tag behavior remain unchanged.

Tag behavior

• main: publishes sha-*, then updates edge
• v*: publishes the version tag, then updates latest
• manual runs: publish the selected version tag and optionally update latest

Testing

• AMD64 container build and smoke tests validated in ci: add safe AMD64 and ARM64 container validation #2637
• ARM64 container build and smoke tests validated in ci: add safe AMD64 and ARM64 container validation #2637
• Digest-based architecture builds complete successfully
• Test manifest contains linux/amd64 and linux/arm64
• Production edge update verified after merge
• Release tag and latest behavior verified with the next release

[fl0rianr]

Converted to draft since the arm code might need further hardening and merge is a no go before further testing anyway.