[codex] Enable arm64 container release publishing

[Jesssullivan]

Summary

• configure the release workflow container image build to publish linux/amd64 and linux/arm64/v8
• add QEMU setup before Buildx so the hosted release runner can build the non-native arm64 image
• add a release-workflow regression test and wire it into task lazy:check
• update distribution docs to keep v0.12.12 arm64 proof open until a future tagged registry packet is archived

Validation

• bash scripts/test-release-workflow-container.sh
• shellcheck scripts/test-release-workflow-container.sh
• task lazy:test-release-workflow-container
• task lazy:check
• task docs:links
• git diff --check

Proof Boundary

This is workflow readiness for the next release. It does not change the already-published v0.12.12 image index, and it does not close the current-tag native linux/arm64/v8 proof gap until a later tag is published and smoked.