ci(release): build arm64 only for stable tags

[Musiker15]

Summary

The release container build was ~13 min, dominated by the QEMU-emulated linux/arm64 cross-build. This makes arm64 conditional: pre-release tags (with a -, e.g. v0.3.0-beta) build amd64-only; stable vX.Y.Z tags keep the full signed multi-arch image.

platforms: ${{ contains(github.ref, '-') && 'linux/amd64' || 'linux/amd64,linux/arm64' }}

Rationale

• The arm64 leg is QEMU-emulated on amd64 runners → several times slower than native; it's the bulk of the build time.
• Beta self-hosters on arm (Raspberry Pi / ARM VPS) are vanishingly rare; the amd64 image everyone pulls today is unchanged.
• Stable releases still get the full multi-arch, cosign-signed image with provenance + SBOM — no change to the supply-chain story for production artifacts.
• Cuts beta releases to ~3–4 min.

Nothing else in the workflow changes (signing, attestation, SBOM, release notes all unchanged). Applies from the next tagged release; the already-published v0.3.0-beta is untouched.

Test plan

• CI green (workflow lint)
• Next beta tag: confirm the build runs amd64-only and finishes in ~3–4 min
• Next stable tag: confirm multi-arch (amd64 + arm64) still builds + signs

🤖 Generated with Claude Code