Enable arm64 runtime smoke execution

.gitea/workflows/runtime-distribution.yml

@@ -39,6 +39,10 @@ on:
         description: Digest-pinned GreenMail image
         required: true
         type: string
+      binfmt_image:
+        description: Digest-pinned tonistiigi/binfmt image for arm64 CI execution
+        required: true
+        type: string
 
 jobs:
   publish-runtime:
@@ -64,6 +68,7 @@ jobs:
           MANAGED_INGRESS_IMAGE: ${{ inputs.managed_ingress_image }}
           GARAGE_IMAGE: ${{ inputs.garage_image }}
           TEST_MAIL_IMAGE: ${{ inputs.test_mail_image }}
+          BINFMT_IMAGE: ${{ inputs.binfmt_image }}
         run: |
           python - <<'PY'
           import os
@@ -82,6 +87,7 @@ jobs:
               "MANAGED_INGRESS_IMAGE",
               "GARAGE_IMAGE",
               "TEST_MAIL_IMAGE",
+              "BINFMT_IMAGE",
           ):
               if image_pattern.fullmatch(os.environ[name]) is None:
                   raise SystemExit(f"{name} must be an exact sha256 image reference")
@@ -213,6 +219,11 @@ jobs:
             --index-digest "${REDIS_IMAGE##*@}" \
             --index runtime-output/redis-index.json \
             --output runtime-output/redis-metadata.json
+      - name: Register arm64 execution for runtime smoke
+        working-directory: govoplan
+        env:
+          BINFMT_IMAGE: ${{ inputs.binfmt_image }}
+        run: docker run --privileged --rm "$BINFMT_IMAGE" --install arm64
       - name: Exercise amd64 and arm64 runtime images
         working-directory: govoplan
         run: |

docs/INSTALLATION_AND_DEPLOYMENT_ARCHITECTURE.md

@@ -160,6 +160,10 @@ as immutable release assets.
 PostgreSQL and Redis indexes are resolved to untagged platform-child digests
 before each smoke run. This keeps the evidence architecture-specific and
 avoids retargeting one local Docker tag between incompatible platforms.
+The CI host registers arm64 execution with an explicitly supplied,
+digest-pinned `tonistiigi/binfmt` image immediately before the smoke. This
+privileged helper is confined to the release runner and is never part of a
+GovOPlaN target deployment or its runtime image set.
 The smoke also proves a bounded post-migration table contract and aborts as
 soon as a required container exits, rather than allowing a dead process to
 consume the full readiness timeout.

tests/test_runtime_distribution_build.py

@@ -92,6 +92,7 @@ class RuntimeDistributionBuildTests(unittest.TestCase):
             "managed_ingress_image",
             "garage_image",
             "test_mail_image",
+            "binfmt_image",
         ):
             self.assertIn(f"inputs.{input_name}", workflow)
 
@@ -148,6 +149,11 @@ class RuntimeDistributionBuildTests(unittest.TestCase):
         self.assertIn("Resolve managed dependency platform images", workflow)
         self.assertIn("--postgres-metadata", workflow)
         self.assertIn("--redis-metadata", workflow)
+        self.assertIn("Register arm64 execution for runtime smoke", workflow)
+        self.assertIn(
+            'docker run --privileged --rm "$BINFMT_IMAGE" --install arm64',
+            workflow,
+        )
         self.assertIn("runtime-smoke-amd64.json", workflow)
         self.assertIn("runtime-smoke-arm64.json", workflow)