ci: build Docker images once per architecture

[huitseeker]

The Docker dry run starts two binary jobs and then seven image jobs. Each image job builds AMD64 and ARM64. When the shared BuildKit layer is missing, the same eight binaries can be compiled again for every image. Run 35223368381 shows this slow path.

This change uses one Bake job for each architecture. Each job builds the shared stage once and reaches all seven image targets. It copies only the Kache report to the Actions runner. Release publishing keeps its current image matrix.

Cold and warm CI runs will show whether the builder stays within its disk limit and reuses its BuildKit and Kache data.

Closes #2651

Changelog

changelog = "none"
reason    = "CI-only change."

[Mirko-von-Leipzig]

Thank you, this looks good. TIL about docker bake - somewhat unintuitive that this is hidden under a random command that isn't just build.

Should we perhaps also include this in our release process? Perhaps by having bake publish the images under a temporary name using the workflow run ID e.g. run-id-<service>. Once finalized, the current publishing step can instead rename the images to their final name.

[huitseeker]

Yes, this would remove repeated work from releases. The release workflow runs docker.yml once to check the images and again to publish them. The publish run repeats both Bake jobs before seven image builds.

For releases, Bake could push each service under the existing immutable_tag, with amd64 or arm64 added to the tag. After all checks pass, one job would combine each pair and add the final release tag. The final release tag would point to the checked images without rebuilding them.