Run Docker frontend builds on BUILDPLATFORM and bound stalled npm installs

[Copilot]

The release image build was stalling in the linux/arm64 frontend npm ci step for hours with no timeout and weak diagnostics. The observed evidence pointed to an unfinished ARM frontend dependency install, but not to a confirmed TypeScript/build failure or a single proven root cause.

• Frontend build stage

  • Move the Node frontend stage to the builder platform so npm ci and npm run build execute natively even when publishing a multi-arch image.
  • Keep the Python runtime stage and published linux/amd64,linux/arm64 image behavior unchanged.

  FROM --platform=$BUILDPLATFORM node:22-alpine AS frontend

• npm install visibility and failure diagnosis

  • Keep npm ci lockfile-based semantics.
  • Add foreground lifecycle-script output, timing, and info-level logs so stalls are visible while the install is running.
  • Add bounded fetch retry/timeouts.
  • On failure, print sanitized npm debug logs and preserve the original exit status.

• Registry/mirror behavior

  • Normalize frontend/package-lock.json resolved URLs to canonical registry.npmjs.org tarballs.
  • Pair that with npm registry host replacement so the existing NPM_REGISTRY build arg remains effective instead of being bypassed by environment-specific lockfile URLs.

• Workflow timeout bounds

  • Add an explicit timeout-minutes: 60 to the build job.
  • Bound the build step and smoke-test step separately so release builds fail fast instead of consuming the default multi-hour window.
  • Preserve current publishing rules: PRs still build without pushing, version tags still publish semver aliases plus latest, and branch dispatches still avoid moving latest.

• Operational note

  • This mitigates the observed emulated ARM frontend bottleneck by removing static-asset installation/build work from the target-platform path.
  • Re-running the old workflow run/tag will not pick up this change; validation should happen from a branch containing the fix, and release publication should use a new version tag that includes it.