feat: support ARM64 macOS standalone validation

[WenYuLuo]

Summary

• make the runtime and node image builds architecture-aware for ARM64
• add explicit PLATFORM=linux/arm64 support to the build workflow
• make standalone startup work on Apple Silicon Docker Desktop
• document the macOS networking, cgroup, and volume requirements

Why

The existing image and runtime paths assumed x86-64. On Apple Silicon this
forced amd64 emulation, while the standalone mount layout also triggered
Docker Desktop VirtioFS failures and its bridge IP was not reachable directly
from macOS.

Implementation

• select ARM64 artifacts for gVisor, openYuanRong, and OpenTelemetry
• derive Python runtime and dynamic-linker paths from the target architecture
• use a Docker named volume for standalone runtime state on macOS
• publish the gateway on 127.0.0.1:80/443 on macOS
• provide sandboxd with the host cgroup namespace and writable controllers
• check yuanrong.service, sandboxd.service, and gateway health explicitly

Validation

• built the runtime EROFS image and full all-in-one image for linux/arm64
• passed the ARM64 sandboxd/runsc privileged e2e
• started the complete standalone stack on Apple Silicon Docker Desktop
• passed basic usage, command stdin, PTY, port forwarding, and reverse tunnel
  SDK examples
• passed 56 SDK unit tests, Ruff, and mypy
• passed ARM64 Dockerfile build checks, shell syntax checks, and
  git diff --check

Docker Desktop must expose cgroup v1 controllers. Privilege provides the
required permissions but cannot replace the required cgroup version or kernel
filesystems.