ci: publish cac, cac-fpm and shared-httpd multi-arch (amd64 + arm64)

One job per matrix leg on the trusted x86 runner: amd64 built natively, arm64
under QEMU, each pushed BY DIGEST (untagged), then
scripts/assemble-multiarch-index.sh creates the existing tags (:phpNN, :latest
for php85 / shared-httpd :latest) from this run's digests. The arm64 step is
continue-on-error with its own timeout, so an arm64 failure publishes the usual
amd64-only tag and a stale arm64 is never re-attached. Build args, base-image
pin, pkg-cache probe, php.net EXPECT_PHP_MIN gate, secrets and the
cac-litespeed/cac-lsphp/shared-ols jobs are untouched. No Dockerfile change.

Adds scripts/tests/multiarch-workflow.test.py (static wiring + tag-scheme
execution) to Shell-Checks, and fixes index-platforms.test.sh line 17 which
tripped lsphp-info-probe.test.sh's early-exit-reader scan on trunk.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb

scripts/tests/index-platforms.test.sh

@@ -14,7 +14,7 @@ cat >"$T/it" <<'STUB'
 #   "create ..." -> appended to $STUB_LOG.
 if [ -n "${STUB_LOG:-}" ]; then
   if [ "$1" = create ]; then echo "create $*" >>"$STUB_LOG"; exit 0; fi
-  ref=$2; a=$(grep -F "$ref=" "$ARCHES" | head -1 | cut -d= -f2); [ -n "$a" ] || exit 1
+  ref=$2; a=$(grep -F -m1 "$ref=" "$ARCHES" | cut -d= -f2); [ -n "$a" ] || exit 1
   printf '{"architecture":"%s"}' "$a"; exit 0
 fi
 [ "$2" = --raw ] || exit 2