ci: publish the sandbox image with buildx for amd64 and arm64

[devin-ai-integration]

Summary

There is no workflow that publishes ghcr.io/usestrix/strix-sandbox — the released 1.1.0 manifest is a hand-run buildx push. #958 changed containers/docker-entrypoint.sh (the host uid/gid remap that makes writable bind mounts work on Linux) and bumped the default image to 1.2.0, which does not exist yet, so this adds a workflow_dispatch job to cut it reproducibly.

Shape matches the published 1.1.0 manifest — an OCI index over linux/amd64 + linux/arm64 with attestations — but each arch builds on its native runner rather than under QEMU (the image compiles five Go tools on top of kalilinux/kali-rolling, so emulated arm64 is hours):

build (matrix: ubuntu-22.04 / ubuntu-22.04-arm)
  buildx --platform <one arch> --provenance=mode=max --sbom=true
  outputs: push-by-digest=true      # no tag written yet
  upload-artifact: <digest>
publish
  docker buildx imagetools create -t $IMAGE:$TAG [-t $IMAGE:latest] $IMAGE@<digest>...

Pushing by digest first and assembling the manifest list at the end means the tag only ever appears once both arches are up, so a half-published tag is not observable. Auth is the workflow's own GITHUB_TOKEN with packages: write — no PAT to rotate.

Dispatch inputs: tag (e.g. 1.2.0) and latest (default true).

Link to Devin session: https://app.devin.ai/sessions/9339cc7f9ad4454e998bba7a06549cd9
Requested by: @0xallam

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[greptile-apps]

Greptile Summary

This PR adds a manually dispatched workflow that builds native amd64 and arm64 sandbox images by digest, then publishes a combined OCI image index.

• Builds each platform independently with provenance and SBOM attestations.
• Transfers build digests through workflow artifacts and publishes the requested version tag, optionally updating latest.
• The ARM runner label prevents the new publication path from completing, and concurrent dispatches can race when updating shared tags.

Confidence Score: 4/5

The workflow should not be merged until the ARM runner label is corrected; publication concurrency should also be guarded to prevent older runs from overwriting shared tags.

Every dispatch requires an arm64 matrix job assigned to ubuntu-22.04-arm, so without a custom matching runner the build dependency never completes and no manifest is published; overlapping runs can additionally update version or latest tags in completion order.

Files Needing Attention: .github/workflows/sandbox-image.yml

Important Files Changed

Filename	Overview
.github/workflows/sandbox-image.yml	Adds the complete multi-platform publication workflow, but selects a nonexistent hosted ARM runner label and leaves mutable tag publication unserialized.

Prompt To Fix All With AI

### Issue 1
.github/workflows/sandbox-image.yml:28-29
**ARM runner label blocks publishing**

Every dispatch schedules the arm64 build on `ubuntu-22.04-arm`, which is not a GitHub-hosted ARM runner label. Without a custom runner carrying that label, the job remains queued and the dependent publish job never creates the requested multi-platform image.

```suggestion
          - os: ubuntu-24.04-arm
            platform: linux/arm64
```

### Issue 2
.github/workflows/sandbox-image.yml:103-106
**Mutable tags lack dispatch serialization**

If two dispatches overlap, both independently update the shared version tag and, by default, `latest`. The run that finishes last wins, so a slower older release can replace the intended image and subsequent pulls receive the wrong build.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "ci: publish the sandbox image with build..." | Re-trigger Greptile}

[greptile-apps]

ARM runner label blocks publishing

Every dispatch schedules the arm64 build on ubuntu-22.04-arm, which is not a GitHub-hosted ARM runner label. Without a custom runner carrying that label, the job remains queued and the dependent publish job never creates the requested multi-platform image.

Suggested change

	- os: ubuntu-22.04-arm
	platform: linux/arm64
	- os: ubuntu-24.04-arm
	platform: linux/arm64

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/sandbox-image.yml
Line: 28-29

Comment:
**ARM runner label blocks publishing**

Every dispatch schedules the arm64 build on `ubuntu-22.04-arm`, which is not a GitHub-hosted ARM runner label. Without a custom runner carrying that label, the job remains queued and the dependent publish job never creates the requested multi-platform image.

```suggestion
          - os: ubuntu-24.04-arm
            platform: linux/arm64
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Mutable tags lack dispatch serialization

If two dispatches overlap, both independently update the shared version tag and, by default, latest. The run that finishes last wins, so a slower older release can replace the intended image and subsequent pulls receive the wrong build.

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/sandbox-image.yml
Line: 103-106

Comment:
**Mutable tags lack dispatch serialization**

If two dispatches overlap, both independently update the shared version tag and, by default, `latest`. The run that finishes last wins, so a slower older release can replace the intended image and subsequent pulls receive the wrong build.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.