bootbox: matchbox serves amd64 Talos assets only, so arm64 nodes cannot PXE-boot #4524

The bootbox tenant module can PXE-boot only amd64 nodes. Its matchbox image bakes in the amd64 Talos kernel and initramfs, so an arm64 machine that boots from it gets an x86 kernel and never comes up.

The amd64 assets come from the Talos build. The matchbox Dockerfile in packages/core/talos copies kernel-amd64 and initramfs-metal-amd64.xz into /var/lib/matchbox/assets, and the Talos Makefile produces *-amd64 assets only. The image is pinned in packages/extra/bootbox/images/matchbox.tag. The upstream matchbox base image is fine, only the payload is amd64.

Serving arm64 nodes needs arm64 Talos kernel and initramfs next to the amd64 ones. The matchbox profiles and groups then have to pick the assets by the architecture of the booting machine, which iPXE exposes as ${buildarch}. #4507 adds arm64 Talos builds, so the assets can come from there.

Until then the multi-arch release gate carries matchbox on its allowlist, with this limitation as the reason. Related to #1961.