ci: publish linux/amd64+arm64 multi-arch images

[man4ish]

Problem

ghcr.io/omnibioai/omnibioai-toolserver:latest is currently published as an amd64-only image. On an arm64 host (e.g. linux/arm64/v8), the container fails immediately with:

exec /usr/local/bin/uvicorn: exec format error

This is because the existing docker/build-push-action step in .github/workflows/ci.yml never set platforms, so Buildx defaulted to the runner's native architecture (amd64) only, and the pushed tag is a single-arch image, not a manifest list.

Fix

CI is updated to build and publish a genuine multi-arch image for both linux/amd64 and linux/arm64:

• Added docker/setup-qemu-action@v3 so the amd64 GitHub-hosted runner can emulate arm64 to actually execute that leg of the build.
• Added platforms: linux/amd64,linux/arm64 to the existing docker/build-push-action step, so the resulting GHCR tag is a manifest list covering both architectures.

Nothing else changes:

• Image name, tag scheme (type=semver, type=raw,value=latest), GHCR login/auth, and job trigger (refs/tags/v*, gated on needs: lint-and-test) are all untouched.
• No Dockerfile changes were needed — requirements.txt (fastapi, uvicorn, httpx, pydantic, pyyaml) is pure-Python or ships prebuilt manylinux aarch64 wheels (pydantic-core), and python:3.12-slim-bookworm already publishes an arm64 variant.

Validation performed

• .github/workflows/ci.yml parsed successfully with yaml.safe_load after the change.
• Built this Dockerfile locally with docker buildx build --platform linux/amd64,linux/arm64 (via a local multiarch/QEMU-enabled builder) — both the linux/amd64 and linux/arm64 legs completed successfully.
• Did not push/publish any image as part of this validation.

Not in this PR

• No changes to nginx-router, docker-compose.yml, or any other repository.
• Does not merge or trigger a real GHCR publish — that only happens on the next v*.*.* tag push, same as today.