ci: smoke test Docker before releases

[peg]

Summary

Follow-up polish after the 1.0 release packaging fix:

• add a CI Docker smoke job that builds and boots the linux/amd64 image on PRs/pushes
• add a linux/arm64 Docker build probe in CI so cross-compile regressions are caught before tag day
• smoke the release Docker image locally before logging in/pushing to GHCR
• remove the now-unnecessary QEMU setup from the Docker release workflow
• update actions/upload-artifact to v7 to clear the Node20 deprecation annotation
• quiet expected health-probe retry noise in Docker smoke loops

Validation

• git diff --check ✅
• YAML parse for .github/workflows/ci.yml and .github/workflows/docker.yml ✅
• go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/ci.yml .github/workflows/docker.yml ✅
• local Docker buildx linux/amd64 build with release ldflags ✅
• local Docker version smoke ✅
• local Docker default serve + /healthz smoke ✅
• local Docker buildx linux/arm64 build probe with --output=type=cacheonly ✅