ci: multi-arch (linux/arm64) support for the Docker image

[HelgDemidov]

What & why

The Docker image (ghcr.io/helgdemidov/refigure) was linux/amd64-only,
an explicit non-goal in the original Docker distribution spec. Reversed
based on live-verified evidence, not assumption:

• Market: DOCX/XLSX remain the dominant enterprise/institutional
  document-interchange format; Apple's iWork has asymmetric compatibility
  with Office (Office can't open .pages/.numbers at all), so Mac users
  sharing externally are forced through .docx/.xlsx regardless. macOS
  enterprise share is growing, and Microsoft brought native Office to
  macOS for enterprise in Jan 2025. PyPI/uvx/MCP-server already work
  natively on Apple Silicon (arm64 Python wheels) — Docker was the one
  format left depending on QEMU emulation for Apple Silicon.
• Competitors: 2 of the project's 5 reference competitors
  (docling-serve, unstructured) already publish official multi-arch
  images including arm64; 3 of 5 publish no official image at all.
• Feasibility: real end-to-end docker buildx build --platform linux/arm64 of the actual (unmodified) Dockerfile succeeded with
  zero dependencies falling back to a source build — every dependency
  (lxml, pypdfium2, pydantic-core, jiter, cryptography,
  pillow, cffi, rpds-py) resolved a real aarch64 wheel. The
  resulting image was smoke-tested under --platform linux/arm64:
  refigure --help, refigure-mcp --help, soffice --version all
  passed. GitHub-hosted ubuntu-24.04-arm runners are GA and free for
  public repos — CI builds arm64 natively, no QEMU anywhere in the
  pipeline.

Full spec (local-only, docs/ is gitignored):
docs/distribution/docker-arm64/docker-arm64-2026-08-22.md.

Changes

• ci.yml: docker-build matrixed across linux/amd64 (ubuntu-latest)
  • linux/arm64 (ubuntu-24.04-arm) — same 4 existing smoke tests on
    both legs, unmodified logic. Note: this renames the job's check
    name on both legs (now platform-suffixed) — required_status_checks
    needs a matching update after merge (replace the old name, add the new
    arm64 leg), same precedent as the original docker-build/mcpb-build
    additions.
• publish.yml: docker-publish split into a matrixed digest-push job
  (per platform, native runners) + a new docker-publish-merge job that
  combines both digests into one multi-arch manifest via docker buildx imagetools create, under the existing X.Y.Z/latest tags. Verifies
  the published manifest lists both platforms before finishing. The
  actual GHCR push path can only be fully verified live on the next real
  tagged release (same constraint the original job had).
• README.md: Docker feature bullet + accordion body now mention the
  multi-arch manifest. No new commands for end users — docker pull
  resolves the right layer automatically, including on Apple Silicon.

Test plan

• ruff check . / ruff format --check . / mypy refigure — clean
• Full pytest --cov — 684 passed, 4 skipped, 99% coverage
• .github/workflows/{ci,publish}.yml — YAML-validated, job
  dependency graph checked (publish → docker-publish → docker-publish-merge)
• Real local docker buildx build --platform linux/arm64 of the
  unmodified Dockerfile — success, zero source-build fallbacks
• Real smoke test of the built arm64 image (refigure --help,
  refigure-mcp --help, soffice --version) — all passed
• Live verification of the actual multi-arch GHCR publish path
  (docker buildx imagetools create/inspect) — only possible on
  the next real tagged release, not before

After merge

required_status_checks needs updating (remove the old single
docker-build check name, add both platform-suffixed names) — same
process as prior distribution-format PRs, done post-merge once the new
check names exist on main.

🤖 Generated with Claude Code