Fix multi-arch Docker image build

[GatewayJ]

Summary

• build the Go binary and csgclaw-cli download stages on the build platform while selecting target-architecture artifacts explicitly
• make the runtime Alpine base image configurable and default it to the official multi-arch alpine:3.23
• add CI checks that verify runtime base platforms and smoke-test both amd64 and arm64 images after push

Why

The previous runtime Alpine mirror can be single-arch, which risks producing an invalid multi-arch image or mixing the wrong architecture into the final runtime image. This change keeps fast mirrored images for build stages while using a verified multi-arch runtime base.

Validation

• git diff --check
• make -n build GO="CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go" PLATFORM=linux ARCH=arm64

Full Docker buildx push was not run locally; the GitLab CI job now performs the architecture validation.

[RussellLuo]

@wanghaojie124 Please help review this.

[wanghaojie124]

Re: runtime multi-arch base — we've already mirrored full multi-arch indexes to ACR:

opencsg-registry.cn-beijing.cr.aliyuncs.com/opencsghq/golang:1.25-alpine
opencsg-registry.cn-beijing.cr.aliyuncs.com/opencsghq/alpine:3.23
(Synced from Docker Hub with docker buildx imagetools create; verified via imagetools inspect.)

Suggest using these for builder + runtime instead of single-arch opencsg_public mirrors or pulling alpine:3.23 from Docker Hub in CI.

[wanghaojie124]

LGTM