[fabricebrito]

The image previously downloaded AMD64 binaries regardless of the target platform. This change supports linux/amd64 and linux/arm64 and publishes a combined manifest after both native CI build/test jobs succeed.

• Select binary downloads by TARGETARCH and add platform-aware local build/test tasks.
• Test tools, binary architecture, identity, extensions, and startup on both native runners; scan each tested image and attach its SBOM to its architecture digest before publishing the combined manifest.
• Fix isolated Hatch and Calrissian runtimes, writable tool configuration, UID consistency, and the default yq launcher.
• Document multi-platform builds and runtime changes.

Validation: both images built and loaded locally. Offline Hatch, Calrissian, dependency, and YAML/TOML checks passed on AMD64 and on ARM64 through BuildKit emulation. Direct ARM64 container execution is unavailable on the local host. The full extension/startup suite and publishing flow remain to be verified by CI.