fix(ci): stop amd64 builds clobbering the arm64 publish cache

[manavgup]

Problem

The multi-arch GHCR publish job timed out at exactly 30 minutes on two of the last three main builds (#835's and #831's merge builds), cancelling the Docker run and silently skipping the deploy both times. Each needed a manual re-run to ship.

Root cause: the amd64-only build job (every PR, every push) writes to the same weekly GHA cache scope the publish job uses, evicting the arm64 layers publish caches there. Result: every publish rebuilds arm64 from scratch under QEMU — ~30 minutes, sitting exactly on the timeout.

Solution

• Dedicated prod-multiarch-<week> cache scope for the publish job. It still reads the shared amd64 scope (layer reuse where arches overlap), but arm64 layers now persist between publishes — subsequent publishes in a week drop from ~30 min to a few minutes.
• Timeout 30 → 45 min so the one genuinely cold build per week clears the line instead of dying at 99%.

Verification

• YAML validated; the change only touches the publish job (main-only), so PR checks exercise build+scan as usual.
• Real proof is the next two merges to main: the first publish will be cold (~30 min, now within the 45-min budget); the second should be dramatically faster off the preserved arm64 cache.

Notes

• Alternative considered: dropping arm64 from the publish matrix. Rejected — Apple Silicon machines pull these images locally.

🤖 Generated with Claude Code