build: cross-compile the image to the target arch

Build stage pinned to BUILDPLATFORM and GOARCH driven by TARGETARCH, so an
amd64 image builds natively from an arm64 workstation instead of running the
Go toolchain under QEMU. TARGETARCH defaults to amd64 — every cluster node is
amd64, and a plain docker build on arm64 would otherwise produce an image the
nodes cannot run.

Dockerfile

@@ -4,7 +4,10 @@
 # That is deliberate — see tasks/6.1-hardened-image.md. It also means the binary
 # must be fully static, hence CGO_ENABLED=0.
 
-FROM golang:1.25-bookworm AS build
+# --platform=$BUILDPLATFORM pins the build stage to the machine doing the
+# building, then Go cross-compiles to $TARGETARCH. Without it, building an
+# amd64 image from an arm64 workstation runs the whole toolchain under QEMU.
+FROM --platform=$BUILDPLATFORM golang:1.25-bookworm AS build
 
 WORKDIR /src
 
@@ -15,13 +18,17 @@ RUN go mod download
 
 COPY . .
 
-# VERSION is stamped in by CI as the commit SHA so a running pod can be traced
-# back to an exact commit.
+# VERSION is stamped in so a running pod can be traced back to an exact build.
 ARG VERSION=dev
 
+# TARGETARCH is supplied by buildx from --platform. Defaulted to amd64 because
+# every node in the cluster is amd64; a plain `docker build` on an arm64
+# workstation would otherwise silently produce an unrunnable image.
+ARG TARGETARCH=amd64
+
 # -trimpath strips local filesystem paths from the binary.
 # -w -s drop DWARF and the symbol table; nothing debugs off the production image.
-RUN CGO_ENABLED=0 GOOS=linux go build \
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build \
       -trimpath \
       -ldflags="-w -s -X main.version=${VERSION}" \
       -o /out/gateway ./cmd/gateway