fix: setup-chainguard-tool composit action to support arm64 runners

[qboileau]

Why

• The nightly's apks job failed on arm64: setup-chainguard-tool hardcoded the
  linux_amd64 release archive and rejected any non-x86_64 runner.
• The same job installed melange twice — once via our verified action (needed by
  the source prefetch step), then again inside
  chainguard-dev/actions/melange-build, whose setup-melange step apt-installs
  a Go toolchain, build-essential and qemu-user-static and then curls an
  unverified melange tarball over ours. A degraded Ubuntu mirror turned that
  apt-get update into a 20+ minute stall.
• None of setup-melange's payload is needed here: Go only builds melange from
  source (version: tip), qemu only emulates a foreign arch, and every apks
  job runs natively on a runner of its own arch. Only bubblewrap is.

How

• arm64 support — resolve-release.sh now maps RUNNER_ARCH (falling back
  to uname -m) to the goreleaser arch, and the archive name, install dir and a
  new arch output follow it. Both melange and apko publish linux_arm64
  archives.
• New setup-bubblewrap action — installs bubblewrap and the apparmor
  profile melange's default Linux runner needs on 24.04
  (melange#1508), lifted
  from setup-melange and nothing else. Skips apt-get update unless the
  image's apt lists are too stale to resolve.
• melange-build → melange-keygen + melange-build-pkg (same bed8050
  pin, v1.6.31). These assume melange is already set up, so the verified install
  is the only one. Build behaviour is unchanged: same bubblewrap runner, same
  --namespace wolfi, same per-config --repository-append/--keyring-append
  accumulation, same per-job throwaway signing key.
• install-dir input used for melange — /usr/local/bin, because
  melange-build-pkg runs sudo melange and sudo searches its own
  secure_path. download-and-verify.sh escalates to sudo only when the target
  isn't writable, so the default tool-cache install stays sudo-free.
• New test tests/test-resolve-release.sh (23 checks, gh stubbed, no
  network): arch mapping in both spellings, per-arch install dir, unsupported
  arch, annotated-tag dereference, commit-sha pin.

[github-actions]

Container image CVE report

base-jre-25

Scanner	Critical	Critical+High	Total
Trivy	✅ 0	✅ 0	0
Grype	✅ 0	⚠️ 9	9

Grype critical+high by component

Component	Findings
busybox 1.38.0-r0	3
libcrypto3 3.6.3-r4	2
libssl3 3.6.3-r4	2
openssl 3.6.3-r4	2

base-monitoring

Scanner	Critical	Critical+High	Total
Trivy	✅ 0	✅ 0	0
Grype	✅ 0	⚠️ 10	14

Grype critical+high by component

Component	Findings
busybox 1.38.0-r0	3
libcrypto3 3.6.3-r4	2
libssl3 3.6.3-r4	2
openssl 3.6.3-r4	2
go.etcd.io/etcd/client/pkg/v3 v3.5.17	1

base-os

Scanner	Critical	Critical+High	Total
Trivy	✅ 0	✅ 0	0
Grype	✅ 0	⚠️ 3	3

Grype critical+high by component

Component	Findings
busybox 1.38.0-r0	3

debug

Scanner	Critical	Critical+High	Total
Trivy	✅ 0	✅ 0	0
Grype	✅ 0	⚠️ 26	37

Grype critical+high by component

Component	Findings
stdlib go1.25.12	12
busybox 1.38.0-r0	3
jline-remote-telnet 3.30.4	2
libcrypto3 3.6.3-r4	2
libssl3 3.6.3-r4	2
openssl 3.6.3-r4	2
golang.org/x/net v0.55.0	1
golang.org/x/text v0.37.0	1

_{Trivy counts fixed vulnerabilities only; Grype includes unfixed, so its totals run higher. Full reports are in the workflow artifacts.}