Build and test the arm64 targets: nothing on the push path compiles for arm64, and no arm64 Linux/Windows leg runs #681

Tracking issue for docs/plans/arm64-build-and-test-matrix.md, which lands with the PR that
closes this. Two build/CI chores.

1. Nothing on the push path compiles for arm64

quality-gate runs make build (host only — linux/amd64 on ubuntu-latest) and
make build-all, which is:

for os in linux darwin windows; do GOOS=$$os go build ./...; done

That sweeps GOOS at fixed GOARCH. Meanwhile goreleaser ships
[linux, darwin, windows] × [amd64, arm64] — all six. So an arm64-only break (a _arm64.go
file, an arch-specific assumption) surfaces at release rather than at review.

ALL_PLATFORMS already names all six and make build PLATFORM=all already produces them. CI
simply never asked. The Makefile documents why it is cheap: the codebase is pure Go, zero
import "C", so one host links the whole matrix with GOOS/GOARCH alone — ~41s against ~13s
host-only.

2. Linux and Windows arm64 are never executed

test and scenario both run [ubuntu-latest, macos-latest, windows-latest] — three of the
five runnable pairs. darwin/arm64 has been covered all along, since macos-latest is Apple
Silicon; linux/arm64 and windows/arm64 are not covered at all.

arm64 standard runners reached GA for private repositories on 2026-01-29 and are free-tier
eligible, so the blocker that existed when platform-test-matrix.md was written is gone.

Cross-compiling proves the code builds for a target. A native runner proves it runs there.
Neither substitutes for the other.

Constraints that shape the work

• No -latest alias exists for arm64. GitHub publishes arm64 runners as version-pinned
  labels only. ubuntu-24.04-arm is chosen because ubuntu-latest is still Ubuntu 24.04 and
  ubuntu-26.04-arm is a preview image — matching versions means the new leg varies
  architecture alone.
• Go's race detector does not support windows/arm64. That leg runs make test instead of
  make test-race; the full suite still runs, only race detection is absent. linux/arm64 is
  supported and runs -race unchanged.
• The Windows pair cannot be version-matched. windows-latest is Windows Server 2025,
  windows-11-arm is a client OS, and no Windows Server arm64 runner exists.

Follow-on

Phase 4 of platform-test-matrix.md — the ruleset change adding test (…) contexts to
12426847 — must now name five contexts per job, not three. Requiring three of five would
leave both arm64 legs advisory while the rest gate: a gate that looks complete and is not. That
plan is updated in this PR, but the ruleset change itself remains its phase 4, unclaimed here.

Note

This PR is the first exercise of the legs it adds. Its own test (ubuntu-24.04-arm) and
test (windows-11-arm) runs are the phase-2 triage data — failures there are findings to file,
not necessarily blockers on the PR.