build: pin docker builds to linux/amd64 and trust homelab CA at runtime

Building on arm64 Mac without GOOS/GOARCH produced amd64 node "exec format
error". The homelab CA was only trusted in the build stage, so the final
distroless runtime couldn't verify Authentik's TLS cert during OIDC discovery.

.gitignore

@@ -2,3 +2,5 @@ cli-&-go-sdk-implementation-plan.md
 design.md
 kafka-management-tasks.md
 .claude/
+
+*.pem

Dockerfile

@@ -1,12 +1,17 @@
 FROM golang:1.26 AS build
 WORKDIR /src
 ENV GOPRIVATE=forgejo.riotpiao.homelab.com
+# forgejo.riotpiao.homelab.com's cert is signed by a homelab-private CA, not
+# a public one -- without this, `go mod download` can't fetch kmsvc-proto.
+COPY hack/homelab-ca.pem /usr/local/share/ca-certificates/homelab-ca.crt
+RUN update-ca-certificates
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN CGO_ENABLED=0 go build -trimpath -o /out/kmsvc-server ./cmd/server
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -o /out/kmsvc-server ./cmd/server
 
 FROM gcr.io/distroless/static-debian12:nonroot
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 COPY --from=build /out/kmsvc-server /kmsvc-server
 USER nonroot:nonroot
 ENTRYPOINT ["/kmsvc-server"]

Dockerfile.queue-operator

@@ -1,10 +1,12 @@
 FROM golang:1.26 AS build
 WORKDIR /src
 ENV GOPRIVATE=forgejo.riotpiao.homelab.com
+COPY hack/homelab-ca.pem /usr/local/share/ca-certificates/homelab-ca.crt
+RUN update-ca-certificates
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN CGO_ENABLED=0 go build -trimpath -o /out/queue-operator ./cmd/queue-operator
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -o /out/queue-operator ./cmd/queue-operator
 
 FROM gcr.io/distroless/static-debian12:nonroot
 COPY --from=build /out/queue-operator /queue-operator