ci: Build Docker Image job only builds linux/amd64; arm64 path is unverified #56

Problem

The Build Docker Image job in .github/workflows/ci.yml runs docker buildx build without --platform, so it always builds the runner's native architecture (currently linux/amd64). Verified in PR LeanerCloud/cloud-commitments-cli#1240's CI run: only linux/amd64 was exercised, even though the production Dockerfile is parameterised for both linux/amd64 and linux/arm64 (Graviton2 for AWS Lambda/Fargate per the Dockerfile build instructions).

Concrete blast radius:

• The arm64 branch of the migrate-download if/else (currently MIGRATE_SHA256="2fea2455...", v4.19.1) is never checksum-verified in CI. A stale arm64 SHA256 ships unnoticed until a manual linux/arm64 build or a Graviton deploy.
• Cross-compilation pathologies (Go module incompatibilities on arm64, frontend toolchain quirks) surface only in production.
• PR fix(docker): align migrate to v4.19.1 and cross-compile builder natively cloud-commitments-cli#1240 cross-verified arm64 manually but CI does not enforce it.

Suggested fix

In .github/workflows/ci.yml's Build Docker Image step (and any other Dockerfile-build jobs), set up docker/setup-qemu-action and pass platforms: linux/amd64,linux/arm64 to the buildx step, or run the job in a matrix over {amd64, arm64} (pinned actions per the repo's existing SHA-pin convention).

Out of scope for PR LeanerCloud/cloud-commitments-cli#1240

PR LeanerCloud/cloud-commitments-cli#1240 is a 4-line Dockerfile alignment fix (migrate v4.19.1 + --platform=$BUILDPLATFORM). The CI matrix gap is pre-existing and orthogonal to that scope.

Surfaced during adversarial review of LeanerCloud/cloud-commitments-cli#1240.