[markfrancisonly]

The release workflow listed ARM64 as a publish target, but only smoke-tested AMD64. Build both architectures on native Ubuntu runners and require both to pass before publishing shared GHCR tags.

• Verify the architecture and run the Claude CLI, Docker CLI/Compose/Buildx, Node.js/npm, Python, Git, and helper smoke checks on each platform.
• Push tested builds by digest, combine them into one manifest, and verify both platforms. Preserve existing latest, commit, and release tags and metadata.
• Verify the published manifest through an anonymous GHCR token request so private packages fail CI even when the publishing account can pull them.
• Document platform selection, native builds, the 64-bit ARM requirement, and the one-time Public package visibility setting.

Validation:

• GitHub Actions passed on the current commit: script checks, regression tests, and native AMD64 and ARM64 builds and smoke tests.
• Local AMD64 build and smoke checks, Compose validation, actionlint, shell/Python syntax, and git diff checks passed.
• Manifest checks cover both digests and all tags, rejecting missing or malformed ARM64 digests.
• The exact anonymous-access step passed against the public Codex image and rejected the inaccessible Claude image with the visibility instruction.

Pull requests do not publish images. The public-access check runs after publication.