feat(CORE-4981): add multiarch build and merge modes

[kaitimmer]

What changed

New multiarch-mode input with two halves:

• build — builds the runner's native platform, pushes it by digest only, uploads the digest as an artifact. GitOps, retagging and Upwind are skipped.
• merge — downloads all digests, combines them into one manifest list, applies the tags, then runs the GitOps/Upwind steps as usual.

Callers wire up the matrix themselves (a composite action cannot create one) — see the new README section. Empty by default, so unchanged callers behave exactly as before.

Also fixes set_output, which could not emit multi-line values: docker-build-platforms / docker-build-outputs now round-trip through GITHUB_OUTPUT, and a multi-line value would have produced an invalid output file.

Why it changed

Our recovery/failover regions have no ARM capacity, so images deployed there must ship both linux/amd64 and linux/arm64. Building natively on one runner per architecture avoids QEMU emulation and cross-compilation entirely.

How to test it

mise run check (110 bats tests + shellcheck). End to end: point a test repo at this branch using the matrix workflow from the README and verify docker buildx imagetools inspect <tag> lists both platforms.

---

_{The changes and/or the PR description has generated by with the help of OpenCode.}

[ricoberger]

Clean split into build/merge, and the pass-through design keeps single-arch behaviour untouched. Test coverage on resolve-build-config and merge-manifests is solid. One non-blocking question inline about the merge job getting pinned to amd64 by the architecture check. Worth exercising against a real workflow — e.g. https://github.com/Staffbase/apperator/blob/ee977bc6ccece6030e97360215c5b68513c80efb/.github/workflows/ci-cd.yml#L56. Reviewed at 8c26511.

[ricoberger]

Merge mode still hits this (gated only on build=='true'), and resolve-build-config passes platforms through as the default linux/amd64. So the merge job — which never builds, it just runs imagetools create — is pinned to an amd64 runner or verify-architecture aborts. Intended? If not, worth skipping this + Resolve Build Configuration when multiarch-mode == 'merge'.

[flaxel]

What is the reason to not reuse the docker build target? 👀