Dockerfile: Go stages pinned to $BUILDPLATFORM, GOOS/GOARCH from TARGETOS/
TARGETARCH (CGO already off); amd64 rootfs/binary byte-identical to before.
Workflow: one trusted x86 job, amd64 + arm64 pushed untagged by digest to both
registries, arm64 continue-on-error, tag assembled by
scripts/assemble-multiarch-index.sh (arm64 only from this run's successful
step; otherwise amd64-only). Offline test + local e2e rehearsal script.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb
