fix(ci): resolve OCI platform before verifying published config

scripts/publish-container.sh

@@ -62,7 +62,7 @@ for target in "$image-migrations" "$image"; do
   # Import may change compression/manifest representation, but the immutable
   # image config digest must still match the exact local image we verified.
   expected_config="$(docker image inspect --format '{{.Id}}' "$target")"
-  remote_config="$(regctl manifest get "$target" --format '{{.GetConfig.Digest}}')"
+  remote_config="$(regctl manifest get "$target" --platform "linux/$arch" --format '{{.GetConfig.Digest}}')"
   [[ "$remote_config" = "$expected_config" ]] || { echo "Published image config does not match verified local image" >&2; exit 1; }
   rm -f -- "$context/image.tar"
 done