ci: mirror multi-platform sandbox images to ghcr

[ChasLui]

Summary

• Mirror the upstream sandbox image as a multi-platform GHCR manifest list instead of pulling a single runner-architecture image first.
• Add explicit source-image platform verification for linux/amd64 and linux/arm64 before publishing.
• Document Docker image support for linux/amd64 and linux/arm64 (aarch64) in README and quick-start docs.

Why

The current workflow pulls the source image before mirroring. On ubuntu-latest, that can resolve to only the runner architecture (linux/amd64), so the GHCR mirror may lose linux/arm64 support. This PR mirrors the upstream manifest list directly with docker buildx imagetools create and fails early if a required platform is missing.

Test Plan

• Static workflow assertions for multi-platform settings
• Source registry manifest check includes linux/amd64 and linux/arm64
• YAML parse check for workflow and docker-compose.yaml
• npx prettier --check .github/workflows/push-to-ghcr.yml
• Docs platform note assertions
• git diff --check

Note: Markdown/MDX full Prettier check already failed on baseline files, so this PR avoids unrelated formatting churn.