fix(build): verify controller binaries match target architecture

[reoring]

Problem

Fixes #6.

The Dockerfile default ARG TARGETARCH=amd64 overrides BuildKit's target, so the ARM64 runtime manifest receives an x86-64 /manager. OCI platform labels do not prove the executable's architecture.

Change

• Inherit BuildKit TARGETOS/TARGETARCH without defaults.
• Validate the built ELF machine, class, and byte order against the independent TARGETPLATFORM before copying /manager into the runtime image. The verifier runs natively on BUILDPLATFORM and uses only the Go standard library.
• Build both linux/amd64 and linux/arm64 in source CI. The same Dockerfile guard runs in the existing release workflow before publication.
• Include the verifier in the Docker build context, add focused positive/negative tests, and update existing build documentation.

No release identity/credential/visibility expansion, API/runtime reconciliation changes, or modifications to published v0.2.8.

Verification

• Built final AMD64 and ARM64 images with the repository Dockerfile; both architecture guards passed.
• Copied /manager from each final image: file reports x86-64 and ARM aarch64 respectively.
• AMD64 image --help: exit 0.
• Extracted ARM64 executable under unprivileged QEMU: --help exit 0. Native ARM64 execution is unavailable on this x86 host without binfmt; no host registration or privileged emulator installation was performed. This is not an ARM64 Kubernetes certification.
• Forced the original bad setting with --platform linux/arm64 --build-arg TARGETARCH=amd64: build failed before final image generation with EM_X86_64 versus EM_AARCH64 mismatch.
• Focused Go tests, go vet, golangci-lint (0 issues), actionlint, gofmt, and git diff --check passed.

Local image IDs:

• AMD64: sha256:3e3858ab4c556052aeb6b778cca40654cb8eee74f4208739f24c42b59bc83baf
• ARM64: sha256:9c05b8fa5a5c5abf13bcca53f1e4c347849ad0f27085c4661f1f6c70645e8bdd

No shared/live deployment or registry publication performed. A subsequent release must use a new version; v0.2.8 remains immutable.

[reoring]

DNS API v0.2.9 release request

Source: cb8b8dd, merged PR #7.
Tested PR head: b240e32.
The tested candidate and selected main have identical tracked trees (git diff --exit-code HEAD origin/main).

Intent: repair the mislabeled ARM64 executable in v0.2.8 without overwriting that published version.
Required artifact closure: ghcr.io/appthrust/dns-api:0.2.9 for linux/amd64 and linux/arm64; oci://ghcr.io/appthrust/charts/dns-api:0.2.9.
Authority: existing version-tag controller-release workflow and existing publication scope. No credential/publisher/visibility changes or environment promotion.

Pre-publication evidence:

• Both local image builds passed the ELF guard against independent TARGETPLATFORM.
• Final AMD64 image ID sha256:3e3858ab4c556052aeb6b778cca40654cb8eee74f4208739f24c42b59bc83baf. This is byte-for-byte the same image ID used by the successful prior local Kind Gateway deletion/recreation and withdrawal probe; that relevant runtime result is reused rather than rebuilding the cluster.
• Final ARM64 image ID sha256:9c05b8fa5a5c5abf13bcca53f1e4c347849ad0f27085c4661f1f6c70645e8bdd; extracted /manager is ELF AArch64 and executes --help under unprivileged QEMU. No ARM64 native-cluster certification is claimed.
• Forcing TARGETARCH=amd64 with target linux/arm64 fails before final image generation.
• Focused tests/vet/lint/actionlint passed. Exact PR CI succeeded, including both image platforms.

The version tag will be fixed to the selected source after exact-main CI and edge publication complete. No silent workflow retry. Final acceptance includes registry digest/config revision readback, extraction of both released executables and ELF verification, and chart version/appVersion verification.

[reoring]

v0.2.9 merge and release completed

• PR fix(build): verify controller binaries match target architecture #7 merged as cb8b8dd.
• PR controller-ci: https://github.com/appthrust/dns-api/actions/runs/34023572939 (success, both image targets built).
• Exact-main controller-ci: https://github.com/appthrust/dns-api/actions/runs/34023998692 (success).
• Exact-main edge publication: https://github.com/appthrust/dns-api/actions/runs/34023998704 (success).
• v0.2.9 annotated tag resolves to the exact merge SHA above.
• Version publication: https://github.com/appthrust/dns-api/actions/runs/34024475087 (image and chart jobs both successful).

Registry and executable readback

Image: ghcr.io/appthrust/dns-api:0.2.9
OCI index: sha256:d36a04256dc7c7ecbea04055b98816f2cfcd696d2b035bf2b1330c8831969d89

AMD64 manifest: sha256:7b3c9de9333108425fbf09274efa3983cef7988e7bc83fcae088f4f1abaf60a5

• Pulled by digest and extracted /manager: ELF64 little-endian, machine 62 (x86-64).
• Released image /manager --help exited 0 with expected manager flags.

ARM64 manifest: sha256:e15454d25bee085ee31e11629c76688bf0b24639809f3c543e1722889d0ca97d

• Pulled by digest and extracted /manager: ELF64 little-endian, machine 183 (AArch64).
• Extracted released binary /manager --help exited 0 under unprivileged QEMU, with expected manager flags.

Both image config revision labels equal cb8b8dd; both version labels equal 0.2.9. This verifies the executable architecture, not merely the OCI platform label.

Chart: oci://ghcr.io/appthrust/charts/dns-api:0.2.9
Chart digest: sha256:8c071ad35a768ebde211037dea995e22656b1270a55994a32157e29682d1d5c6
helm show chart confirms version=0.2.9 and appVersion=0.2.9.

Boundaries

• v0.2.8 was not overwritten or rerun.
• No shared environment deployment, Payment DNS mutation, or current live Payment recovery assertion.
• ARM64 verification is ELF inspection and emulated startup, not native ARM64 Kubernetes certification.
• No Platform signed-catalog certification is claimed for this standalone DNS-API tag/OCI release.
• Inspection and smoke containers were removed; host binfmt and credentials were not modified.