Publish multi-architecture container images

[mormamn]

Description

• Build AMD64 and ARM64 images on native runners for both standard and SageMaker variants.
• Pass image digests to a final job that publishes the combined manifests after both builds succeed.
• Preserve snapshot, versioned release, and latest tags. Run the existing container checks on both architectures.

Validation

• pnpm checks, pnpm test (219 files, 2,668 tests), and actionlint pass.
• Both variants build for both architectures and pass local architecture, OpenSSL, package-removal, and /status checks. AMD64 runtime checks used local emulation.
• Ran the workflow's digest-push and manifest scripts against a local registry with minimal test images; all six tags contain both architectures and the expected variant digests.

Upstream CI awaits maintainer approval. Publishing to the upstream ECR repository requires maintainer credentials.

Related Issues

• Fixes [Feature Request] Change container image build workflow to create multi-architecture images  #132

Check List

• I confirm that my contribution is made under the terms of the Apache 2.0 license.
• I have verified pnpm checks passes with no errors.
• I have verified pnpm test passes with no failures.
• I have covered new added functionality with unit tests if necessary.
• I have updated documentation if necessary.

[kmcginnes]

Thanks for this, and welcome. Multi-arch images have been asked for since #132, so this is a useful one to pick up. I've also linked #1143 to this PR since it asks for the same thing, so both will close when this merges.

Fair warning on timing, it may be a little while before I can give this a proper review. Anything touching the publish workflow I'd rather verify carefully than skim.

[mormamn]

No worries, thank you very much @kmcginnes