fix(hub): pin and verify multiarchitecture production images

[Copilot]

Why

The production Ruby and Node image tags could resolve to different contents without a source change. Pinning their official multiarchitecture indexes addresses code-scanning alerts 3 and 4 while retaining the current runtime tracks.

What changes

Hub CI builds AMD64 and ARM64 images in parallel from one job definition on native runners, avoiding QEMU overhead. Each image must pass the existing image checks and start successfully. The unchanged Production image check requires both architectures to pass and permits skipped builds only when suite selection explicitly excludes Hub.

Releases also build each architecture on its native runner, using one validated version and immutable source revision. Build jobs publish by digest without updating release tags. One final job combines both digests and applies the existing stable or prerelease tags, then uploads the deployment bundle once. A failed architecture blocks that job. Release publication has not been exercised against GHCR; no release was triggered.

The maintenance guide explains refreshing image tags and digests together. Existing Dependabot configuration does not update Docker images; no new update process is added.

Alert 5 remains unchanged. Bundler deployment mode already freezes dependencies; the image's Bundler rejected inconsistent and missing lockfiles without rewriting them. The scanner rule should recognize deployment mode rather than require redundant configuration.

[Copilot]

🔵 Needs a closer look

The restructured GHCR publication flow remains unexercised and needs human verification.

No open issues 🎉

_{Review effort: Max}