harden: pin container image digest, document ARM64 QEMU trade-offs

- Pin catthehacker/ubuntu:act-22.04 to digest sha256:52581951... to
  prevent supply-chain drift from mutable tags
- Add ARM64 builds section to README documenting QEMU emulation
  trade-offs and when to switch to native ARM64 runners (Rust builds)
- Update Notes section to reference new ARM64 docs and digest pinning

Ref: CON-578

.gitea/workflows/build-push.yaml

@@ -49,7 +49,7 @@ jobs:
     name: Build & Push
     runs-on: ${{ inputs.runner }}
     container:
-      image: catthehacker/ubuntu:act-22.04
+      image: catthehacker/ubuntu:act-22.04@sha256:52581951350bf4f1137d44883626850bdfa35a8e5318b95dcb22226caece3bc9
       options: --privileged
     outputs:
       image-tag: ${{ steps.tag.outputs.tag }}