fix: stage LP4 architecture gates

[Sythos]

Summary

• make the LP4 commit gate fast amd64-first by default
• keep functional, Compose, and typed contract proofs on amd64
• add an explicit final ARM64-only multiarch gate with QEMU and OCI attestation verification
• record the architecture mode in the LP4 manifest and documentation

Verification

• amd64 commit gate: https://github.com/Sythos/GuloGulo/actions/runs/32822859245
• final ARM64 gate: https://github.com/Sythos/GuloGulo/actions/runs/32823586608
• local
  pm run test:lp4, manifest/static checks, and git diff --check passed

The branch is a temporary correction branch and may be deleted after the required checks pass and the PR is merged.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f4f720c290

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Require ARM64 validation before merge

Checked both caller workflows: automatic pull-request and push events leave inputs.architecture_mode unset, so this expression always selects amd64; multiarch is reachable only through a manual dispatch. Moreover, both modes emit the same reusable-job check name, so branch protection cannot specifically require the manual ARM64 result. A successful amd64 check can therefore permit merging without any ARM64 validation, contrary to the new arm64RequiredBeforeMergeOrRelease contract; expose ARM64 as a distinct automatically triggered required check or otherwise make the dependency enforceable.

Useful? React with 👍 / 👎.