ci: Improve multi-architecture manifest publishing (no-changelog)

[shortstacked]

Summary

• Limit the manifest job checkout to CI helper files.
• Remove the temporary BuildKit builder because imagetools does not use it.
• Build each image index from immutable SHA-tagged architecture images.
• Apply primary, SHA, and optional date tags in one operation.
• Publish the four image families concurrently to GHCR and Docker Hub.
• Preserve explicit failure handling and OCI image index assertions.

How to test

1. Run actionlint .github/workflows/docker-build-push.yml.
2. Run pnpm exec prettier --check .github/workflows/docker-build-push.yml.
3. Run node --test .github/scripts/docker/assert-manifest-format.test.mjs.
4. Dispatch the Docker build workflow for a branch build.
5. Confirm that the manifest job creates all primary and SHA tags.
6. Confirm that the OCI image index assertions pass.

Related Linear tickets, Github issues, and Community forum posts

None.

Review / Merge checklist

• I have seen this code, I have run this code, and I take responsibility for this code.
• PR title and summary are descriptive. (conventions)
• Docs updated or follow-up ticket created.
• Tests included.
• PR Labeled with Backport to Beta, Backport to Stable, or Backport to v1 (if the PR is an urgent fix that needs to be backported)

🤖 PR Summary generated by AI

[cubic-dev-ai]

Running ultrareview automatically — This modifies core CI/CD image manifest publishing, touching multi-arch tag creation, concurrency, and failure handling — a bug here could break production image availability and deployment tags.. I'll post findings when complete.

[n8n-assistant]

PR review overview

Based on ownership of the 1 changed file in this PR:

Ownership	Files owned	Share	Source code	Test files	Misc
@n8n-io/qa-dx	1	100%	+83 / -71	+0 / -0	+0 / -0
Total	1	100%	+83 / -71	+0 / -0	+0 / -0

Required reviews

Some changed files have a required owner in OWNERS. A member of each of these teams must approve this PR before it can merge:

Team	Files
@n8n-io/qa-dx	1

Request a review from the team — GitHub assigns reviewers according to the team's review settings. The Auto-assign reviewers label does this for all owning teams.

[cubic-dev-ai]

Ultrareview completed in 7m 56s

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would require human review. This changes the operational behavior of public multi-architecture image publishing, including tag creation and concurrency across registries. Human review is needed to validate the rollout and tag/registry semantics.

Re-trigger cubic</sub>