build-push: default to multi-arch on the amd64 runner

Flips two defaults and adds setup-qemu-action so every caller that
doesn't override now produces a linux/amd64,linux/arm64 manifest list
out of the box, running on the new k8s-runner-amd64 in the primary
cluster (with QEMU emulating arm64 in the same dind sidecar).

Why now: the wectrl k8s cluster gained an x86 builder node, and the
warm-standby cluster in hel1 is already x86. With multi-arch images,
both clusters can pull the same manifest — no more per-arch divergence,
no more rebuilds when migrating workloads between clusters.

Callers can still pin to a single arch (`platforms: linux/arm64`) or
keep the existing arm runner (`runner: ubuntu-latest`) when an ERPNext-
sized build would be unacceptable under QEMU. Most JS/Astro/static
images aren't bottlenecked by the emulated leg.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-push.yaml

@@ -20,10 +20,10 @@ on:
         type: string
         default: "Dockerfile"
       platforms:
-        description: "Target platforms (e.g. linux/arm64, linux/amd64)"
+        description: "Target platforms (e.g. linux/amd64,linux/arm64). Default builds multi-arch — both clusters can pull the same manifest."
         required: false
         type: string
-        default: "linux/arm64"
+        default: "linux/amd64,linux/arm64"
       build-args:
         description: "Docker build args (newline-separated KEY=VALUE)"
         required: false
@@ -35,10 +35,10 @@ on:
         type: string
         default: ""
       runner:
-        description: "Runner label to use (e.g. ubuntu-latest, self-hosted-arm64). ARM64 builds use QEMU emulation on amd64 runners by default — set this to a native ARM64 runner for faster Rust/heavy builds."
+        description: "Runner label to use. Default is `amd64` (the k8s-runner-amd64 on the x86 builder node); arm64 leg is built via QEMU on the same host. Set to `ubuntu-latest` to fall back to the ARM runner — useful for Rust/heavy builds that benefit from native arm64."
         required: false
         type: string
-        default: "ubuntu-latest"
+        default: "amd64"
     secrets:
       REGISTRY_USER:
         required: true
@@ -114,6 +114,13 @@ jobs:
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
 
+      # Install QEMU binfmt_misc handlers inside the dind sidecar so
+      # buildx can emulate the non-native target arch. On the amd64
+      # runner this enables linux/arm64 builds; on the arm runner it
+      # enables linux/amd64. No-op when only one platform is targeted.
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3