Enable native ARM64 (aarch64) Docker build (#2648)

[exzile]

Summary

Enables building and running OpenVINO Model Server natively on aarch64 (ARM64) Linux as a CPU-only image, addressing #2648.

Every change is architecture-conditional — the x86_64 build path and its outputs are unchanged (the amd64 defaults are byte-for-byte identical). Nothing is removed. This intentionally differs from the earlier draft #2485, which deleted S3FileSystem and hard-swapped lib paths (regressing x86).

Scope

• CPU-only minimal/release image on Ubuntu 22.04 (BASE_OS=ubuntu22) using pre-built OpenVINO binaries (OV_USE_BINARY=1). The OpenVINO GenAI nightlies publish aarch64 archives for Ubuntu 22.04 only, hence ubuntu22.
• GPU/NPU are x86-only and skipped on ARM.
• Not in scope: official multi-arch image publishing.

Changes

• Makefile: TARGETARCH (amd64/arm64) selects --platform, the OpenVINO lib subdir (intel64/aarch64) and the control-flow-protection flag; the GPU release-image variant is restricted to amd64.
• Dockerfile.ubuntu: arch-conditional Bazel install (arm64 standalone binary), parameterized OV runtime lib dir, arch-conditional control-flow flag, skip x86-only intel-opencl-icd and the Intel GPU driver install on arm64, arch-agnostic bazel-out glob.
• common_settings.bzl: control-flow protection via select() — -fcf-protection=full on x86, -mbranch-protection=standard on aarch64.
• third_party/opencv/install_opencv.sh: same control-flow flag selection.
• third_party/openvino/BUILD: link libopenvino.so from lib/aarch64 on ARM.
• src/main_capi.c: compare the C-API smoke-test output with a tolerance instead of an exact memcmp — ARM CPU defaults to f16 inference precision, so the exact f32 match spuriously failed. No-op on x86.
• create_package.sh: arch-agnostic bazel-out glob; $(uname -m) multiarch dir for libOpenCL (tolerated absent on CPU-only ARM); OpenVINO runtime lib dir intel64/aarch64; guard patchelf of libopenvino_tokenizers.so (not shipped in the aarch64 GenAI package).
• docs/build_from_source.md: TARGETARCH option and a "Building for ARM64 (aarch64)" section.

How to build

make release_image \
    TARGETARCH=arm64 BASE_OS=ubuntu22 OV_USE_BINARY=1 \
    DLDT_PACKAGE_URL=<aarch64 OpenVINO GenAI package> \
    GPU=0 MEDIAPIPE_DISABLE=1 PYTHON_DISABLE=1

Validation

Built and run on a native ubuntu-24.04-arm runner:

• build → capi-build → pkg → release all build successfully.
• The resulting image runs: ovms --version reports OpenVINO Model Server 2026.3.0 / OpenVINO backend 2026.3.0.
• It serves the test dummy model on the aarch64 CPU plugin; /v2/health/ready returns 200.

Questions for maintainers

• Is a community ARM64 PR welcome, or is this tracked internally (CVS-129299)? Happy to align. cc @atobiszei @bstrzele
• libopenvino_tokenizers.so is not present in the aarch64 OpenVINO GenAI package, so the tokenizers extension is unavailable on ARM (logged as a non-fatal warning). Flagging in case that package should also ship the aarch64 tokenizers library.

Closes #2648