fix: combine per-arch tags with imagetools, not docker manifest

docker manifest create refuses a source that is itself a manifest list:
  ERROR: ...:<tag>-amd64 is a manifest list
With Docker containerd image store, docker build --platform linux/amd64
produces an OCI index rather than a plain manifest, so BOTH per-arch tags are
lists and the combine fails — after the slow multi-hundred-MB pushes have
already succeeded. The failure mode is nasty: the per-arch tags are published
and the PLAIN tag, the one both Deployments reference, is absent. Hit on
12.11.1-ci6, 2026-08-31.

buildx imagetools create accepts indexes as sources and combines registry-side,
so it works with either image store. Verification switches to imagetools
inspect and now asserts both linux/amd64 and linux/arm64 specifically, rather
than counting two distinct architecture strings.

push-image.sh

@@ -99,15 +99,27 @@ for arch in amd64 arm64; do
   docker push "$REPO:$TAG-$arch" || die "push failed for $arch"
 done
 
-docker manifest rm "$REPO:$TAG" >/dev/null 2>&1 || true
+# `docker manifest create` REFUSES a source that is itself a manifest list:
-docker manifest create "$REPO:$TAG" --amend "$REPO:$TAG-amd64" --amend "$REPO:$TAG-arm64"
+#   ERROR: gitea.langenoja.se/...:<tag>-amd64 is a manifest list
-docker manifest push "$REPO:$TAG"
+# With Docker's containerd image store, `docker build --platform linux/amd64`
+# produces an OCI index rather than a plain manifest, so both per-arch tags are
+# lists and the combine step fails after the (slow, large) pushes have already
+# succeeded — leaving the per-arch tags published and the plain tag absent,
+# which is the one the Deployments reference. Seen on 12.11.1-ci6, 2026-08-31.
+#
+# `buildx imagetools create` accepts indexes as sources and does the combine
+# registry-side, so it works with either image store.
+docker buildx imagetools create -t "$REPO:$TAG" "$REPO:$TAG-amd64" "$REPO:$TAG-arm64" \
+  || die "failed to combine the per-arch tags into $REPO:$TAG"
 
 # Verify by reading it back, rather than trusting the push's exit code.
 echo "verifying the published manifest lists both architectures"
-got=$(docker manifest inspect "$REPO:$TAG" | grep -o '"architecture": *"[a-z0-9]*"' | sort -u | wc -l)
+inspect=$(docker buildx imagetools inspect "$REPO:$TAG") \
-[ "$got" -ge 2 ] || die "published manifest does not list two architectures"
+  || die "published $REPO:$TAG cannot be read back"
-docker manifest inspect "$REPO:$TAG" | grep -o '"architecture": *"[a-z0-9]*"' | sort -u
+got=$(echo "$inspect" | grep -o 'linux/[a-z0-9]*' | sort -u | grep -cE 'linux/(amd64|arm64)')
+[ "$got" -ge 2 ] || die "published manifest does not list both architectures:
+$inspect"
+echo "$inspect" | grep -o 'linux/[a-z0-9]*' | sort -u
 
 cat <<EOF