speed up PR image builds

[dgageot]

Summary

• keep PR image validation multi-arch for linux/amd64 and linux/arm64
• skip provenance generation for PR-only image builds
• export a smaller BuildKit cache for PR builds
• split the Dockerfile Linux image builder from the cross-platform binary builder so Linux image builds avoid the osxcross SDK path

Expected outcome

PR image builds should spend less time on metadata/cache export and avoid unnecessary osxcross work, while main/tag image publishing keeps full multi-arch SBOM and max provenance behavior.

Validation

• docker buildx build --check .
• docker buildx build --platform linux/amd64 --build-arg GIT_TAG=pr --build-arg GIT_COMMIT=dev --progress=plain .
• workflow YAML parse