Add arm64 multi-arch release artifacts (closes #26)

[abienkowski]

Summary

Implements full arm64 support across all three implementations (Go, Rust, TypeScript), enabling releases and deployments on arm64 servers (Hetzner CAX31, AWS Graviton, Oracle Ampere, etc.).

Closes: #26

What's Included

Binary Releases

• Go: amd64 + arm64 matrix builds with CGO_ENABLED=0 (statically linked)
• Rust: amd64 + arm64 cross-compilation (x86_64-unknown-linux-musl, aarch64-unknown-linux-musl)
• TypeScript: Platform-independent Node archive (works on any arch)

Asset naming: docker-socket-policy-{go,rs,ts}-linux-{amd64,arm64}

Docker Images

• Multi-arch manifest indexes (linux/amd64, linux/arm64)
• Auto-detection on docker pull — correct architecture selected per host
• Built via docker buildx with platforms: linux/amd64,linux/arm64

Release Workflow

• Matrix builds for Go (2 parallel amd64/arm64 jobs)
• Matrix builds for Rust with cross-compilation (2 parallel jobs)
• SBOM and Cosign operations conditional (if: matrix.arch_name == 'amd64') to prevent race conditions on image registry
• All three implementations publish to GitHub releases + GHCR

Documentation

• reproducible-builds.md: arm64-specific verification examples, multi-arch image documentation
• README.md: "Supported Architectures" subsection, per-arch binary naming, corrected static linking claims

Impact

Unblocks: ChainSafe/lodestar-infrastructure#9 (docker-socket-policy Ansible role deployment)

The 3x Hetzner CAX31 arm64 hosts in the lodestar fleet (stable-arm64, unstable-arm64, beta-arm64) now have a fully supported install path:

• Prebuilt arm64 binaries (Go, Rust)
• Multi-arch Docker images
• Full verification documentation

Implementation Details

Go (Task 1)

• Added matrix strategy to release-go job: goarch: [amd64, arm64]
• Binary environment: CGO_ENABLED: 0, GOOS: linux, GOARCH: ${{ matrix.goarch }}
• Conditional Docker/SBOM/Cosign gates to amd64 job only

Rust (Task 2)

• Created .cargo/Cross.toml for cross-compilation config
• Added matrix strategy to release-rust job with target mapping:
  • x86_64-unknown-linux-musl → amd64
  • aarch64-unknown-linux-musl → arm64
• Installed cross tool for arm64 cross-compilation
• Same conditional gating as Go

Dockerfiles (Task 3)

• Removed hardcoded --platform=linux/amd64 pins from all FROM statements
• Updated go/Dockerfile: Use ${TARGETARCH} for GOARCH (buildx auto-detect)
• Updated rs/Dockerfile: Use ${TARGETPLATFORM} with case statement mapping to Rust target triples
• Updated ts/Dockerfile: Removed pins for consistency (already multi-arch capable)

Verification (Task 8)

• YAML syntax validated
• Dependency graph correct (verify → version → release jobs → publish)
• Race conditions eliminated via conditional gating
• All edge cases handled

Testing

All changes validated via:

• Spec compliance review (all requirements met exactly)
• Code quality review (idiomatically correct, maintainable)
• Final integration validation (99% confidence)

Related Issues

Builds on:

• PR fix: bind Unix socket listener in Rust for --listen-socket #27 (Rust unix-socket listener — closes Rust implementation ignores --listen-socket and is TCP-only (no UnixListener, no fd:// socket activation) #25)

Enables resolution of:

• No graceful connection draining on shutdown in Rust (and TS): in-flight requests dropped on SIGTERM #28 (graceful shutdown drain — P2)
• Rust fd://3 socket activation adopts the fd blindly — no validation it is a listening socket #29 (fd://3 validation — P3)
• Process exits 0 (Rust) / hangs (Go) when all listeners fail to bind — defeats Restart=on-failure #30 (exit code on all-listeners-failed — P2)