Add multi-arch (amd64+arm64) buildx support for alpine Docker image

[ihalatci]

What

Adds linux/arm64 build capability to the Citus alpine Docker image by replacing the single-arch Python Docker SDK build/tag/push path in packaging_automation/publish_docker.py with docker buildx build subprocess calls.

Refs citusdata/citus#8612.

Why

The base images (postgres:18.4 / postgres:18.4-alpine) already publish arm64/v8 manifests. The alpine Citus image builds Citus from source (./configure && make install) with no arch-specific packages, so it is arm64-capable today. The Debian images install pinned .deb packages that don't yet exist for arm64, so only alpine goes multi-arch here — every other image stays amd64-only with functionally unchanged behavior.

Cross-repo dependencies

• ci: add gated arm64 (.deb) leg to citus community nightlies packaging#1198 adds the gated arm64 community-nightly .deb build leg. It is coordinated with this PR and starts populating the arm64 package index required for future Debian-based Citus images, but it is not a prerequisite for the alpine image implemented here.
• A follow-up in citusdata/docker must add QEMU/buildx setup, set DOCKER_BUILD_MULTI_ARCH, and consume a new citusdata/tools release containing this change. Until that workflow change opts in, Docker publishing remains amd64-only.

Changes

• get_platforms() — gates alpine multi-arch behind env var DOCKER_BUILD_MULTI_ARCH (truthy set 1/true/yes/on). Default OFF → linux/amd64 for all images, preserving today's behavior. When ON, only alpine → linux/amd64,linux/arm64.
• run_buildx_build() — one docker buildx build call per image:
  • publishing → --push (multi-arch manifests can't be --loaded; must go straight to the registry),
  • not-publishing + single-arch → --load (parity with old local-image behavior),
  • not-publishing + multi-arch → build-only (validates arm64 compile in PRs, output discarded).
• Rewrote the 3 build functions to make one buildx call each; the tagged flow passes the full semver cascade (e.g. 14, 14.1, 14.1.0) as multiple -t flags in a single build+push.
• Removed dead SDK code (import docker, module-level clients, flush_logs()).

Companion changes

• Test: relaxed test_publish_tagged_docker_images_alpine to drop the images.get(...) asserts and rely on run_buildx_build's check=True (gate-agnostic; with the var ON alpine is build-only so there's no local image to get).
• Workflow: added docker/setup-qemu-action@v3 + docker/setup-buildx-action@v3 to publish-docker-image-tests.yml. DOCKER_BUILD_MULTI_ARCH is intentionally left unset so tools PR/unit CI stays amd64-fast; arm64 is exercised at publish time by the citusdata/docker workflows.

Compatibility & follow-ups

• amd64-only images keep functionally-equivalent behavior (default-OFF gate).
• buildx --push requires a prior docker login — the citusdata/docker publish workflows already log in; buildx reads ~/.docker/config.json, so ordering is compatible.
• After merge: a new citusdata/tools release tag must be cut and the citusdata/docker workflows repinned (currently citusdata/tools@v0.8.36).
• QEMU/buildx setup on the citusdata/docker publish workflows is handled separately.

Risk

Emulated arm64 alpine source-build under QEMU is slow (30–60+ min). Mitigated by the default-OFF env gate — the tools repo never pays this cost unless a workflow explicitly opts in.

Validation

Local: py_compile OK on both Python files; grep confirms zero leftover docker_client/docker_api_client/flush_logs/import docker refs; AST check confirms all test-imported symbols present and flush_logs removed. Full pytest (real builds cloning citusdata/docker) not run locally — it runs in CI.

Diff stat: 3 files changed, 53 insertions(+), 48 deletions(-).