ci: native amd64/arm64 matrix build (stack 2/2)

[duncdrum]

Stacked on #22 (dp-feat-v2, which contains the --platform=\$BUILDPLATFORM Dockerfile change). Merge #22 first; this PR then retargets to main.

What

• Replace the single job + QEMU-emulated arm64 build with a build matrix on native runners:
  • linux/amd64 on ubuntu-latest, cache buildcache-x86
  • linux/arm64 on ubuntu-24.04-arm, cache buildcache-arm
• Both platforms are now booted and run through the bats suite (arm64 was never tested before).
• On main, each job pushes its image by digest; a merge job creates the multi-arch :latest and :v2 tags with docker buildx imagetools create. Published tags are unchanged for users.
• Removed QEMU setup; maximize-build-space and the containerd redirect are amd64-only, with a best-effort cleanup on arm64.
• Added concurrency so superseded PR runs are cancelled (never main/schedule).
• Dropped the base_ref == 'main' job guard so PRs targeting other branches (this stack) get CI.
• Cache writes from PRs are kept as before.

Review notes / risks

• First arm64 runner run may need a disk-space iteration (df is printed in the check os step; hosted arm64 runners have less disk than the LVM-expanded x86 one).
• download-artifact@v7 is assumed to exist alongside upload-artifact@v7.
• The push/merge path only runs on main and has not been exercised yet; first validation is the next push to main or a manual workflow_dispatch on main.
• actionlint warns about SC2024 (pre-existing containerd step) and SC2046 (intentional word splitting in the imagetools create call).

🤖 Generated with Claude Code