ci: build multi-arch images on native runners

[aptend]

Summary

• Build linux/amd64 on ubuntu-22.04 and linux/arm64 on ubuntu-22.04-arm.
• Remove QEMU from the MatrixOne image build path.
• Push per-platform staging images to DockerHub and ACR, then publish the existing nightly/release multi-arch tags only after both builds succeed.
• Keep the existing optools/images/Dockerfile; this PR does not introduce the new native/Go cache design.
• Split the existing registry cache tag by architecture to avoid concurrent writers, with the current shared cache retained as the migration fallback.

Why

MatrixOne run 29962616189 spent about 45m55s in the emulated arm64 build versus 5m13s for native amd64. Native thirdparty/CGO work was about 8m42s and the ARM Go build about 37m13s. GitHub now provides a standard native ubuntu-22.04-arm runner, so QEMU is no longer necessary.

Validation

• actionlint v1.7.12 passed.
• git diff --check passed.
• Independent high-level review found no merge blocker.
• Failure closure checked: if either platform fails, the manifest job is skipped and neither the canonical version tag nor latest is published.

[aptend]

End-to-end validation passed: https://github.com/matrixorigin/matrixone/actions/runs/29988739259

Measured wall time:

• Full workflow: 6m42s (07:36:35 to 07:43:17)
• Native arm64 job: 4m56s; Docker build step 4m32s; make build layer 175.1s
• Native amd64 job: 6m08s; Docker build step 5m43s; make build layer 224.9s
• Manifest publication: 28s

Baseline run 29962616189 took 51m12s. This is a 44m30s reduction, about 87%, without changing MatrixOne Dockerfile or adopting the new Go/native cache design.

Both DockerHub and ACR manifest inspections contain linux/amd64 and linux/arm64 entries. The additional unknown/unknown entries are the provenance attestations emitted by build-push-action.