perf(ci): patch releases (vX.Y.Z, Z>0) shouldn't pay for arm64

[Metbcy]

Problem

Multi-arch container builds (linux/amd64 + linux/arm64) take ~25-30 minutes because arm64 runs under QEMU emulation. For patch releases that don't change runtime behavior (docs, CI fixes, lint cleanup), this is dead weight: the 'wait for CI' loop is longer than the work itself.

Suggested fix

Modify .github/workflows/release.yml's 'build + sign container image' job to gate the arm64 platform on the tag pattern:

- name: Choose platforms
  id: platforms
  run: |
    if [[ "${GITHUB_REF#refs/tags/}" =~ ^v[0-9]+\.[0-9]+\.0$ ]]; then
      echo "platforms=linux/amd64,linux/arm64" >> "$GITHUB_OUTPUT"
    else
      echo "platforms=linux/amd64" >> "$GITHUB_OUTPUT"
    fi

- uses: docker/build-push-action@v6
  with:
    platforms: ${{ steps.platforms.outputs.platforms }}
    ...

Result: minor + major releases (vX.Y.0) keep multi-arch; patches (vX.Y.Z where Z > 0) are amd64-only and finish in ~5 min.

Acceptance criteria

• A v0.10.x patch tag completes the entire release pipeline in <8 min.
• A v0.11.0 minor tag still ships both amd64 and arm64.
• cosign verify still works on both arches where present.
• CHANGELOG entry for the next minor explains the policy.

Difficulty

~1 hr (workflow change + one release-cycle to verify).