ci: cross-compile arm64 from amd64 (no GH-hosted arm runners)

- docker.yml: drop ubuntu-24.04-arm. Both arches now build on
  hanzo-build-linux-amd64 via docker buildx + QEMU for the arm64 leg
  (QEMU is acceptable for Docker builds per policy).
- release.yml: drop the imaginary hanzo-build-linux-arm64 runner. Both
  arches cross-compile on hanzo-build-linux-amd64 with GOOS=linux
  GOARCH=<arch> (CGO_ENABLED=0).

.github/workflows/docker.yml

@@ -12,15 +12,20 @@ permissions:
 jobs:
   build:
     strategy:
+      fail-fast: false
       matrix:
-        include:
-          - arch: amd64
-            runner: ubuntu-latest
-          - arch: arm64
-            runner: ubuntu-24.04-arm
-    runs-on: ${{ matrix.runner }}
+        arch: [amd64, arm64]
+    # No GH-hosted arm runners. arm64 builds via Docker buildx with QEMU on
+    # the amd64 self-hosted runner (QEMU is acceptable for Docker builds).
+    runs-on: hanzo-build-linux-amd64
     steps:
       - uses: actions/checkout@v4
+      - name: Set up QEMU
+        if: matrix.arch == 'arm64'
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: arm64
+      - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -30,12 +35,15 @@ jobs:
         run: |
           TAG=${GITHUB_REF#refs/tags/}
           IMG=ghcr.io/luxfi/mpc:${TAG}-${{ matrix.arch }}
-          docker build -t $IMG .
-          docker push $IMG
+          docker buildx build \
+            --platform linux/${{ matrix.arch }} \
+            --tag "$IMG" \
+            --push \
+            .
 
   manifest:
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     steps:
       - uses: docker/login-action@v3
         with:
@@ -54,7 +62,7 @@ jobs:
   notify:
     needs: manifest
     if: startsWith(github.ref, 'refs/tags/v')
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     steps:
       - uses: peter-evans/repository-dispatch@v3
         with:

.github/workflows/release.yml

@@ -10,9 +10,12 @@ permissions:
 jobs:
   build:
     strategy:
+      fail-fast: false
       matrix:
         arch: [amd64, arm64]
-    runs-on: ${{ matrix.arch == 'arm64' && 'hanzo-build-linux-arm64' || 'hanzo-build-linux-amd64' }}
+    # All builds run on the amd64 self-hosted runner. arm64 cross-compiles
+    # via GOARCH; CGO_ENABLED=0 keeps it pure-Go (no cross-compiler needed).
+    runs-on: hanzo-build-linux-amd64
     env:
       GONOSUMCHECK: '*'
       GONOSUMDB: '*'
@@ -23,9 +26,10 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version: '1.26.3'
-      - name: Build
+      - name: Build (cross-compile via GOARCH)
         run: |
-          GOWORK=off CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o mpcd ./cmd/mpcd/
+          GOWORK=off CGO_ENABLED=0 GOOS=linux GOARCH=${{ matrix.arch }} \
+            go build -trimpath -ldflags="-s -w" -o mpcd ./cmd/mpcd/
       - name: Upload
         uses: actions/upload-artifact@v4
         with: