CD publishes the arm64 image without ever smoke-testing it

[torridfish]

Problem

Since #64, CD publishes linux/amd64,linux/arm64 manifests, but the smoke test in .github/workflows/cd.yml only ever runs the amd64 image:

• Build amd64 image for smoke test builds linux/amd64 with load: true — buildx cannot load a multi-platform result into the runner's daemon.
• Smoke-test production lifecycle offline runs that amd64 image.
• Push smoke-tested image (amd64 + arm64) builds the arm64 half under QEMU and pushes it without ever running it.

So the arm64 image — the one that actually runs on the OCI Ampere deploy host — ships unverified. An arch-specific wheel resolving differently, or a native dependency (OpenJTalk / fugashi) misbehaving on aarch64, would go undetected until deploy.

[torridfish]

Two ways to close this:

1. Native arm64 runner. ubuntu-24.04-arm has been GA and free for public repos (4 vCPU) since Aug 2025, so this repo qualifies. Real aarch64 execution at near-native speed; costs a job split — build/push and the arm64 smoke test land on different runners, so the image has to move between them via the registry or the gha cache.
2. QEMU on the existing runner. docker run --platform linux/arm64 after a single-platform arm64 load. Minimal restructuring, but emulated boot needs the current wait loop (30 × 1s for /openapi.json, 30s for the accent call) widened a lot, and makes CD noticeably slower.

Leaning towards 1.

[torridfish]

Duplicate of #67 — merged into it.

#67 already proposes the native `ubuntu-24.04-arm` matrix build that was the preferred option here, and its "Complication worth planning for" section is this issue's problem. The verification gap described here is now recorded on #67 as an explicit acceptance criterion (arm64 must smoke-test on its own native runner, and tags publish only after both arch tests pass): #67 (comment)

Tracking the work on #67.