Closes #10581

Why

Goreleaser's buildx docker builds set --platform per architecture
(see .goreleaser.yml), but the Dockerfile pinned FROM to
BUILDPLATFORM (the build host's architecture). The debian base
layer therefore always matched the CI runner instead of the
requested target, so multi-arch images (e.g. the arm64 tag built on
an amd64 runner) shipped a base OS of the wrong architecture while
only the copied updatecli binary matched the intended target.

Testing

Built the Dockerfile locally with buildx targeting a platform other
than the build host's, both before and after the change:

$ docker buildx build --platform linux/amd64 -f docker/Dockerfile -t test:old --load .   # BUILDPLATFORM
$ docker inspect test:old --format 'Architecture={{.Architecture}}'
Architecture=amd64
$ docker run --rm --platform linux/amd64 --entrypoint dpkg test:old --print-architecture
arm64   # mismatch: base OS is the build host's arch, not the requested target

$ docker buildx build --platform linux/amd64 -f docker/Dockerfile -t test:new --load .   # TARGETPLATFORM (this PR)
$ docker inspect test:new --format 'Architecture={{.Architecture}}'
Architecture=amd64
$ docker run --rm --platform linux/amd64 --entrypoint dpkg test:new --print-architecture
amd64   # matches the requested target

With this change, dpkg --print-architecture inside the built image
matches the --platform value passed to buildx, confirming the base
image now tracks the requested target platform instead of the build
host.

Summary by CodeRabbit

• Build Improvements
  • Docker images now use the intended target platform during multi-platform builds, helping ensure the resulting image matches the platform it is built for.