ci: switch reth-x to public ECR (multi-arch + per-chain aliases)

[littlehand26]

What

Migrate reth-x writer CI (build.yml + release.yml) from private ECR to the shared public ECR repo, multi-arch, with per-chain writer aliases.

Changes (both build.yml and release.yml)

• Registry: 294354037686.dkr.ecr.ap-northeast-1.amazonaws.com → public.ecr.aws/b2h7a5c4/chaintable
• IMAGE: blockchain-rethx → reth-x (repo-level image name)
• AWS_REGION: ap-northeast-1 → us-east-1 (public ECR is us-east-1 only)
• Multi-arch: matrix [amd64] → [amd64, arm64]
• OIDC creds: configure-aws-credentials@v1 (no role) → @v4 with role-to-assume: secrets.AWS_ROLE_ARN
• ECR login: added registry-type: public
• Permissions: added id-token: write (OIDC)
• New merge-docker-manifest job: builds the repo-level multi-arch manifest from the two arch tags, then for each chain in CHAINS creates a <chain>-writer alias pointing at the same digest. release.yml additionally tags latest.
• CHAINS env: plasma botanix

Per-chain images produced

• reth-x (repo-level multi-arch)
• plasma-writer
• botanix-writer

Preserved quirks

• Raw docker build / docker push flow with git submodule update --init --recursive (kept, not switched to build-push-action).
• --short=7 revision format (reth-x existing convention).
• OP_IMAGE env var left declared (op-reth fork lineage; unused in build steps as before).
• Dockerfile untouched — it is already TARGETPLATFORM-aware (amd64 sets x86-64-v3 + pclmulqdq RUSTFLAGS; arm64 falls through to native default).

Notes

• reth is a Rust build (cargo-chef). arm64 builds natively on the self-hosted arm64 runner (no cross-compile), so risk is moderate (Rust build is heavy but native).