mirror-base-image.yaml pulled the upstream index digest on an amd64 runner and re-pushed it, publishing only the amd64 manifest; the python/golang mirrors had no arm64 variant. Replace pull/tag/push with a registry-to-registry `imagetools create` of the digest-pinned index via .gitea/scripts/ mirror-index-copy.sh: copy to <tag>-staging, assert linux/amd64+linux/arm64 are listed and the index digest equals the Docker Hub digest, then move the real tag and re-assert. A failed assertion never touches the real tag. Adds a local-registry test (.gitea/scripts/test-mirror-index-copy.sh). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb