Publish multi-arch (amd64 + arm64) oro-app and oro-ingest images #174

Goal

Publish ghcr.io/openrobops/oro-app and ghcr.io/openrobops/oro-ingest as multi-arch manifests (linux/amd64 + linux/arm64) so the stack runs natively on Apple Silicon Macs via Docker Desktop. Kubernetes on amd64 nodes is unaffected: pulling a multi-arch tag resolves to the amd64 image as today.

When

After the repository goes public. GitHub's ubuntu-24.04-arm hosted runners are free for public repos; on a private repo they are billed "larger runners" that must be configured at the org level. QEMU emulation on ubuntu-latest was considered and rejected for the app image: meteor build plus native module compilation (bufferutil, utf-8-validate) under QEMU is 5-10x slower and risks the 6h job limit.

Approach

Native per-arch builds + manifest merge (the pattern recommended in the Docker docs):

1. Matrix build job over [ubuntu-latest, ubuntu-24.04-arm] in both build-app-image.yml and build-ingest-image.yml.
   • Keep the current flow per runner: build with load: true, run the smoke test natively, then a second (fully cached) build-push-action step with outputs: type=image,push-by-digest=true,name-canonical=true,push=true.
   • Upload each digest as an artifact.
   • Separate layer cache ref per arch (e.g. :buildcache-amd64, :buildcache-arm64); the registry cache backend cannot share one ref across arches.
2. Merge job downloads the digests and creates the manifest list with docker buildx imagetools create -t <tags> <image>@<digest>..., using the same docker/metadata-action tags as today. Keep the 3-attempt retry around the push.
3. Dockerfile changes
   • app/Dockerfile: derive METEOR_ARCH from BuildKit's TARGETARCH (amd64 -> os.linux.x86_64, arm64 -> os.linux.aarch64) instead of the hardcoded default, so one build command works for both. Meteor 3.x ships a Linux aarch64 dev bundle; confirm the installer step on the first arm64 run.
   • ingest/Dockerfile: no change expected (Node base images are multi-arch, npm ci only).
4. Release workflow: verify release.yml / RELEASING.md still hold with the merge job producing the final tags.
5. Docs: note arm64 support in the README / getting-started, and mention docker compose on Apple Silicon works without platform: overrides.

Out of scope

• Windows / other arches.
• Mongo and the MQTT broker: already multi-arch upstream images.

Acceptance

• docker buildx imagetools inspect ghcr.io/openrobops/oro-app:latest lists both linux/amd64 and linux/arm64.
• docker compose up on an Apple Silicon Mac pulls arm64 images with no emulation warning.
• CI wall time for the app image stays in the same range as today.