Make CI more consistent

[artemnikitin]

Summary

Make the image upload flow more consistent across architectures while keeping PR builds read-only.

What changed

• keep validate-config ahead of image builds so invalid GitOps runtime config fails before rootfs work starts
• keep the linux/arm64 and linux/amd64 matrix, and add target_arch so upload buckets can be resolved per architecture
• move GCS upload into the same matrix build job instead of using a separate upload-gcs artifact handoff stage
• let each main build leg upload to S3 and GCS when that architecture's bucket is configured, with explicit skip messages when a bucket is unset
• update README.md and AGENTS.md to document the architecture-specific S3/GCS bucket contract and the in-job upload flow

Why

• make the CI flow symmetric between arm64 and amd64
• remove the extra post-build GCS stage while preserving main-only cloud uploads
• keep bucket-per-architecture explicit, because both architectures produce the same *-rootfs.ext4 filenames