[CI] Build multi-arch images on native runners

[jabenedicic]

What Changed

• Replaced the single-runner + QEMU container build with a 2-arch matrix that runs on native ubuntu-24.04 (amd64) and ubuntu-24.04-arm (arm64) runners.
• Added a new merge-manifest job that composes the per-arch digests into the final multi-arch manifest tagged :<sha> and :<latest|git-tag> via docker buildx imagetools create. Published tag scheme is unchanged so deploy/*.yaml consumers are unaffected.
• Re-enabled linux/arm64 publishing — both architectures now ship.
• Slimmed Dockerfile to a runtime-only image. The in-container Go builder stage is gone; each runner cross-compiles the binary natively into dist/${TARGETOS}-${TARGETARCH}/arcade and the Dockerfile just copies it in. ca-certificates is retained because arcade is an outbound HTTPS client (teranode, merkle, datahub, webhook delivery) and TLS handshakes need the system CA bundle.
• Added make docker-build target that mirrors the CI layout for one-shot local image builds, tagging arcade:local.
• Updated .dockerignore to allow dist/linux-amd64/ and dist/linux-arm64/ through (replacing the stale !dist/linux/ carve-out left over from a goreleaser path that's no longer used — .goreleaser.yml has skip: true).
• Removed docker/setup-qemu-action — no longer needed.
• All action SHAs pinned per tech-conventions/github-workflows.md.

Why It Was Necessary

linux/arm64 was previously disabled because building the Go binary inside the container under QEMU emulation was slow and unreliable. Running each architecture on a native GitHub-hosted runner removes QEMU from the picture entirely:

• Native compile of the Go binary on real silicon
• Native apk add ca-certificates on real silicon
• Per-arch image is built and exercised on its target architecture before being published, catching arch-specific regressions at build time rather than at deploy time

ubuntu-24.04-arm runners are GA for public repositories and free, which makes this approach a clean fit for arcade specifically.

The gating chain (gofortress-gate → get_tag → build → publish) is preserved exactly as it was, so the F-041 / arcade#99 publishing-gate guarantees still apply.

Testing Performed

• Workflow YAML parses cleanly.
• Walked through the workflow logic by inspection: GoFortress gating preserved; get_tag deployment-tag logic preserved; PR builds still verify (push: false) per arch with no login and no digest export; non-PR builds push by digest only and the merge job composes the final manifest.
• The two-phase pattern (push by digest per arch, then imagetools create) is the Docker-recommended idiom for cross-runner multi-arch builds.
• Local make docker-build exercised end-to-end on Apple Silicon (linux/arm64): cross-compiles into dist/linux-arm64/arcade, builds and tags arcade:local.
• The runners themselves haven't been exercised end-to-end before opening this PR — that's what this PR's CI run will do.

Impact / Risk

• Breaking change: none for image consumers. Tag scheme is identical: ghcr.io/bsv-blockchain/arcade:<sha> and :<latest|git-tag>. The deploy/*.yaml manifests pull :latest and continue to work unchanged.
• CI runtime: comparable or faster. amd64 build is unchanged; arm64 was previously disabled, now it's a parallel native job.
• Local dev: docker build . in a clean checkout no longer works because the Dockerfile expects a pre-built binary in the dist tree. make docker-build is the new one-shot. Documented inline in the Dockerfile header comment.
• Runner availability: ubuntu-24.04-arm free-tier runners have separate concurrency limits from amd64. Under heavy CI load arm64 could backlog. Falling back to QEMU is a one-file change if this becomes an issue in practice.

Note on branch name: my source fork enforces a feature//release//hotfix/ branch-name regex, which is why this PR's head branch is feature/native-arm64-build rather than the chore/ prefix that matches this repo's tech-conventions/commit-branch-conventions.md. Happy to rename if needed; the commit message itself uses the ci(build): type per upstream convention.

[github-actions]

👋 Thanks, @jabenedicic!

This pull request comes from a fork. For security, our CI runs in a restricted mode.
A maintainer will triage this shortly and run any additional checks as needed.

• 🏷️ Labeled: fork-pr, requires-manual-review
• 👀 We'll review and follow up here if anything else is needed.

Thanks for contributing to bsv-blockchain/arcade! 🚀