fix(ci): resolve OCI platform before verifying published config

scripts/publish-container.sh

@@ -62,7 +62,7 @@ for target in "$image-migrations" "$image"; do
   # Import may change compression/manifest representation, but the immutable
   # image config digest must still match the exact local image we verified.
   expected_config="$(docker image inspect --format '{{.Id}}' "$target")"
-  remote_config="$(regctl manifest get "$target" --format '{{.GetConfig.Digest}}')"
+  remote_config="$(regctl manifest get "$target" --platform "linux/$arch" --format '{{.GetConfig.Digest}}')"
   [[ "$remote_config" = "$expected_config" ]] || { echo "Published image config does not match verified local image" >&2; exit 1; }
   rm -f -- "$context/image.tar"
 done

src/lib/publish-container.test.ts

@@ -89,6 +89,7 @@ it("bounds uploads and verifies both published image configs", () => {
 	expect(calls).not.toContain("docker push");
 	expect(calls.match(/regctl image import/g)).toHaveLength(2);
 	expect(calls.match(/regctl manifest get/g)).toHaveLength(2);
+	expect(calls.match(/--platform linux\/amd64/g)).toHaveLength(2);
 });
 it.each(["upload-fails", "wrong-config", "bad-checksum"])(
 	"stops publication on %s",