feat: enable linux/arm64 (multi-arch) companion images (#466)

[antoinetoussaint-byte]

Closes#466.

Summary

• Every service-* language agent now ships linux/arm64 (go 0.0.43, python 0.0.57, nextjs 0.0.147, rust 0.0.35, swift 0.0.18, generic 0.0.34), so the amd64-only pin on companion publishing is no longer needed — an arm64 companion can now resolve every language agent.
• Publish companions as a multi-arch manifest (linux/amd64,linux/arm64) instead of amd64-only, so an arm64 host can run language services from the registry images.
• Guard the live footgun — codefly companion build/publish on Apple Silicon defaults to arm64 (dockerArch() → arm64), and before the agents shipped arm64 that produced a companion that could not run a single language service — with a standing CI check that every language agent is still shipping linux/arm64.

Notes

• The parent issue’s "bump the pins in pkg/sourceworkspace/source.go" item does not apply, as the issue states. Post-feat: automate source plugin pin promotions (#409) #430 the source-workspace version pins live in pkg/sourceworkspace/compatibility.json and are promoted through a separate qualification gate (agent promote-source); they are intentionally left untouched. The new check therefore validates each agent’s latest resolvable release, not the compatibility pin — the arm64 signal that matters for a companion is whether each agent is still shipping the arch at all, not which version a source workspace happens to launch.
• Multi-arch buildx needs an emulator and a manifest-capable builder, so the publish job gains docker/setup-qemu-action + docker/setup-buildx-action. companion publish already routes multi-platform builds through docker buildx build --push.
• The check (codefly agent verify-platform linux/arm64) reuses the existing agent release inventory (agent versions), so "resolvable" means the same downloadable-artifact signal, just for arm64. It runs in the standing verify gate (CLI release + daily), which is the right cadence: it surfaces an agent that drops arm64 before the next manual companion publish.

Test plan

• go build ./...
• go test ./cmd/agents/... ./pkg/sourceworkspace/...
• New unit tests: pass when every rostered agent ships arm64; fail (naming the agent) when one does not; normalizePlatform accepts both linux/arm64 and linux_arm64.
• Real smoke test against GitHub: codefly agent verify-platform linux/arm64 resolves go 0.0.43 / python 0.0.57 / nextjs 0.0.147 / rust 0.0.35 / swift 0.0.18 / generic 0.0.34 and passes; a bogus arch fails listing the shipped platforms.
• CI: companions.yaml verify job runs the arm64 check green; a manual workflow_dispatch publish produces multi-arch manifests (requires Docker Hub credentials).