nightly: native arm64 runners + merge-by-digest (multi-arch)

[thepagent]

Follow-up to #21 / #22. Supersedes the closed cross-linker PR (#23).

Why this approach

GitHub provides free Linux arm64 hosted runners (ubuntu-24.04-arm) for public repos (announced 2025-01-16). openab-pty is public, so the right shape is to build each arch on its own native runner rather than cross-compiling from a single amd64 runner.

This removes every source of trouble from the previous multi-arch attempt:

• No musl cross toolchain — the arm64 cross-link that failed run 33774193328 (musl-tools only ships the host arch's musl-gcc), and no musl.cc external dependency.
• No QEMU — the arm64 runtime RUN steps (npm, CLI installers) run natively.
• The arm64 image is actually smoke-tested on real arm64 hardware. The cross-build could only test amd64 and shipped arm64 unverified.

Workflow shape

• build: matrix (variant × arch) on ubuntu-24.04 / ubuntu-24.04-arm. Each leg builds into the local daemon, smoke-tests natively (now also asserts the image architecture), then pushes by digest only (no tag) and uploads the digest as an artifact. grok excludes arm64 (vendor ships no arm64 binary — issue Multi-arch images: publish linux/arm64 so arm64 hosts run natively (not x86_64 under Rosetta) #21).
• merge: one job per variant runs docker buildx imagetools create to bind the per-arch digests under the moving (nightly-<variant>) and immutable (nightly-<date>-<run>-<variant>) tags — composing the exact bytes each native runner tested, with no rebuild.

Dockerfile.nightly

• Builder reverts to a plain native build (no --platform pin, no cross toolchain); musl-tools + rustup target add for the host arch is all a native build needs.
• Runtime per-vendor arch tokens keyed on TARGETARCH are unchanged (correct for native single-platform builds too).
• devin's per-arch sha256 is now selected by the leg's arch, not fixed to x86_64.

Verification

Native arm64 kiro build (same as the ubuntu-24.04-arm runner will do):

Arch: arm64
uname -m: aarch64
openab-pty ELF e_machine: 0xB7 (AArch64)

CI on this PR builds (and smoke-tests) both arches without pushing; the digest push + manifest merge run on non-PR events.

Note on preview status

ubuntu-24.04-arm is a public-preview label but has been stable and GA-track for months. If GitHub ever changes availability, the fallback is the cross-build approach from #23.