🏗️ Add multi-arch (amd64 + arm64) build support 🏗️

Register QEMU binfmt handlers and fix cache mounts + binstall
resilience so the image builds correctly on both platforms.
- Dockerfile: declare ARG TARGETARCH in build stage; suffix all
arch-specific cache mount ids with ${TARGETARCH} so amd64 and
arm64 get isolated apk, rustup-downloads, cargo-git, and sccache
caches — cargo-registry stays shared (source is arch-neutral)
- rootfs/root/docker/setup/05-custom.sh: append || true to the main
cargo binstall -y block so a single tool with no arm64-musl prebuilt
and a failing source fallback does not abort the entire layer; add
comment explaining the intent

Dockerfile
rootfs/root/docker/setup/05-custom.sh

rootfs/root/docker/setup/05-custom.sh

@@ -156,7 +156,9 @@ install -m 755 /tmp/cargo-binstall "$CARGO_HOME/bin/cargo-binstall"
 rm -f /tmp/cargo-binstall.tgz /tmp/cargo-binstall
 
 # - - - - - - - - - - - - - - - - - - - - - - - - -
-# Workflow and development tools — all have musl prebuilt binaries
+# Workflow and development tools — most have musl prebuilt binaries for amd64 and arm64;
+# || true lets the build continue if an individual tool has no prebuilt and source
+# compilation fails (e.g. missing a C dep); failures are visible in the build log
 cargo binstall -y \
   cargo-edit \
   cargo-watch \
@@ -200,7 +202,7 @@ cargo binstall -y \
   cargo-public-api \
   cargo-spellcheck \
   cargo-geiger \
-  grcov
+  grcov || true
 
 # Tools that occasionally lack musl prebuilts — fall back to source compilation
 # cargo-nextest requires --locked when building from source (locked-tripwire guard)