ci: add native arm64 RPM compatibility builds

[proddata]

Requirement

Keep docs/rpm-platforms.md accurate and add native arm64 compatibility builds for the existing Fedora 43, Fedora 44, and Rocky Linux 10 / PGDG PostgreSQL 18 targets.

Changes

• Expand RPM CI from three x86-64 jobs to a six-cell distribution × architecture matrix. Keep the existing x86 check names and add arm64 jobs on GitHub's native ubuntu-24.04-arm runner.
• Pin the Rocky PGDG arm64 repository bootstrap RPM to its architecture-specific URL and verified SHA-256. Reject unsupported repository architectures.
• Add opt-in arm64 Compose services with separate build volumes, and record RPM architecture in /etc/pg-oauth-build-inputs.
• Update the platform guide with the full matrix, native arm64 commands, and the distinction between compatibility checks and production support.

Trust boundary and failure behavior

The installer accepts the PGDG bootstrap only after SHA-256 verification; DNF package signatures remain enabled. A missing or unexpected architecture fails the Rocky build. No validator authentication behavior or production support contract changes. RPM-family jobs still do not run the real-server OAuth integration suite or SELinux-enforcing tests.

Compatibility and operations

The default Compose services and existing x86 check names remain unchanged. On arm64, build and run the *-arm64 services described in docs/rpm-platforms.md. The arm and x86 build volumes are separate. Revert this commit to return to the three-job x86 matrix; no persistent application data or configuration migrates.

Verification

• Native arm64 image builds and verify-dev packagecheck passed locally for Fedora 43, Fedora 44, and Rocky Linux 10.
• Rocky arm64 reported libcurl 8.12.1 with threaded DNS during its runtime gate.
• Fedora 44 arm64 build-input manifest recorded rpm-architecture: aarch64.
• Both Compose configurations validated; shell syntax, source-tree hygiene, diff checks, and the six-job YAML matrix check passed.
• CI on native GitHub arm64 runners will provide the independent confirmation. Fedora 44's local test server printed a BrokenPipeError after a peer disconnected, but the verification command exited successfully.

The RPM repositories remain unsnapshotted compatibility inputs. Offline RPM packaging, installed-runtime tests, and SELinux-enforcing OAuth integration remain future support gates.