[indigo423]

Closes #242

Release and rc image builds compiled linux/arm64 under QEMU on x86 runners. The arm64 npm ci step sometimes died with a QEMU SIGILL and then hung until the 6 h job limit. Both v0.7.9 and v0.7.10 needed reruns.

What changes

• Each platform builds natively in a matrix: linux/amd64 on ubuntu-26.04, linux/arm64 on ubuntu-26.04-arm. The free arm64 runners work because the repo is public.
• Each build pushes an untagged image by digest and uploads the digest as an artifact.
• A merge job runs docker buildx imagetools create to make one multi-arch index and tag it.
  • release.yml: vX.Y.Z, vX.Y and latest. Cosign signs the index with --recursive as before, then the draft release is created.
  • ci.yml: rc.
• QEMU setup is removed. Each platform gets its own GHA cache scope.
• Every job in release.yml and both image jobs in ci.yml have timeout-minutes.
• The version guard and make verify move into their own verify job in release.yml. Nothing is pushed unless they pass.
• New checkouts use persist-credentials: false. Both files get the SPDX header that e2e.yml already has.

Verification

• actionlint passes on all workflows. The local version doesn't know the ubuntu-26.04* labels yet, so I ran it with that warning ignored. The runner-images README lists both labels.
• zizmor --offline findings went down: ci.yml from 2 to 1 and release.yml from 3 to 2. The remaining ones were already on main.
• Not yet exercised on GitHub. The image jobs skip on pull requests. The ci.yml path runs on the first push to main after merge. The release.yml path runs on the next tag.

Review focus

• The Dockerfile has no $BUILDPLATFORM stages, so native builds need no Dockerfile change.
• After the next release, check that cosign verify still passes and that the tag shows both platforms in imagetools inspect.

🤖 Generated with Claude Code

https://claude.ai/code/session_0197CGJEYqF3wKcTPJdnsnDq