ARM64 controller image contains an x86-64 manager executable #6

Observed defect

The v0.2.8 controller-release run succeeds and publishes a linux/arm64 OCI manifest, but its /manager executable is x86-64. Do not treat this release as ARM64-ready.

• Source: b229115
• Release workflow: https://github.com/appthrust/dns-api/actions/runs/34022565139
• Image index: ghcr.io/appthrust/dns-api@sha256:7027332c2a97d4a146d6307c4d743dbc191bd41d5f22bcb1f0774b028bf67851
• ARM64 manifest: sha256:0fce8a612c7106ae4eb61ef7b24f929755a91daa20f20a3e3739a7ee7b29a517
• AMD64 manifest: sha256:85b27bad26674869fc614cefec3bad90df4d631b5cd89c25ff532a123abbd018
• Both manifests contain the same final /manager layer: sha256:581e06d187098a503cd5928964c6f00e296ea5380b55194a6641f7c8a54bb64e

Direct verification

Pulled the ARM64 manifest by digest with docker pull --platform linux/arm64, created a stopped inspection container, copied /manager, and ran file:

ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked

The inspection container was removed without executing it. No shared environment writes occurred.

Source lead and proposed correction

The existing Dockerfile declares ARG TARGETOS=linux and ARG TARGETARCH=amd64, then compiles with GOOS=${TARGETOS} GOARCH=${TARGETARCH}. Use BuildKit target-platform automatic arguments without overriding their defaults, and verify the actual executable architecture of both outputs before publication. This packaging code was not modified by DNS recovery PR #5.

Keep the already published v0.2.8 immutable. Reproduce and fix the architecture selection locally, then publish a new version through the existing release workflow. This issue is separate from the Gateway EndpointRecordSet deletion-watch fix, which passed source tests and the local AMD64 image/Kind scenario.