Arm64 support for SF releases (binary and images)

[maoueh]

Summary

Supersedes #25 — same goal (native linux/amd64 + linux/arm64 release images and binaries, to support AWS Graviton), rebuilt on top of it with the sha/tag publish races fixed and verified against a live run.

What changed vs #25

• sf_release.yml split into prepare → build (matrix, native amd64/arm64 runners) → manifest → release, same as Arm64 Support for SF Releases (binary and images) #25's approach.
• Manifest is now assembled from content-addressed image digests exported by each matrix leg, not by re-reading the mutable per-arch tags — a concurrent run can no longer substitute a different image into a published manifest.
• Added a concurrency guard (queue, not cancel) so a re-run or a second workflow_dispatch on the same ref can't race the images a prior run is still assembling.
• Firehose Ethereum base is pinned by digest once in prepare and passed to both matrix legs, so both architectures in a manifest are guaranteed to embed the same fireeth build (the two legs build on separate runners and previously resolved FROM independently).
• Only branch builds publish the bare commit-sha tag now — a tag pushed on a release/* branch head previously started two runs racing to publish the same sha tag.
• Removed the <version>-fireeth-<...> tag; verified the previous format was doubling the version (e.g. v3.11.2-fh3.0v3.11.2-fh3.0-fireeth-...) against every tag currently on the registry.
• Registry login restored ahead of the fireeth digest lookup (was dropped in Arm64 Support for SF Releases (binary and images) #25's split, works today only because the default image is public).
• Bumped docker/login-action, docker/metadata-action, docker/build-push-action, actions/upload-artifact, actions/download-artifact to their Node 24 releases.
• Did not carry over Arm64 Support for SF Releases (binary and images) #25's Makefile change (ARCH ?= linux/amd64 default) — nothing in this release pipeline calls make docker, and defaulting local builds to amd64 would silently emulate on arm64 dev machines.

Testing

Pushed this branch's commit as a throwaway release/* branch to trigger a real run end-to-end: both matrix legs built and pushed, digests uploaded, manifest assembled and pushed. Confirmed docker manifest inspect on the resulting tag shows both amd64 and arm64 platforms. One transient GHCR unknown blob push error on the first attempt, cleared on retry — registry flakiness, not a workflow bug. Test branch and run artifacts cleaned up after.

Test plan

• Merge to release/v3.x-fh and confirm a real branch push builds and publishes cleanly
• Push a tag and confirm the release job extracts both nitro_linux_amd64 and nitro_linux_arm64 and attaches them to the GitHub release

[sduchesneau]

lgtm