Add Makefile and bin/ scripts for one-command multi-arch release

make release builds, smoke-tests and pushes amd64 (on fsn1app1 via
DOCKER_HOST) and arm64 (local), joins them into latest and dated
multi-arch manifests, and commits the day's logs. Logic lives in bin/;
the Makefile only wires dependencies so -j2 runs the arches in parallel.

bin/test

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Smoke-test a built image: toolchains resolve, yarn/pnpm work offline,
+# nothing left in /tmp, and runsvinit stops a runit service cleanly on
+# docker stop with exit code 0.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+. bin/lib.sh
+
+arch="${1:?usage: bin/test <arch>}"
+use_arch_host "$arch"
+img="$(dev_tag "$arch")"
+name="baseimage-test-$arch-$$"
+
+echo "== $img: toolchains and cleanup"
+docker run --rm "$img" bash -ec '
+    # cleanup checks first: node writes a compile cache into /tmp when run
+    test -z "$(ls -A /tmp)"
+    test ! -e /usr/share/doc/bash
+    test ! -e /tmp/build.sh
+    go version; node --version; python3 --version; hugo version | head -1
+    COREPACK_ENABLE_NETWORK=0 yarn --version
+    COREPACK_ENABLE_NETWORK=0 pnpm --version
+'
+
+echo "== $img: runit service lifecycle"
+docker rm -f "$name" >/dev/null 2>&1 || true
+docker run -d --name "$name" "$img" bash -ec '
+    mkdir -p /etc/sv/demo
+    printf "%s\n" "#!/bin/bash" "exec 2>&1" \
+        "trap \"echo demo: got TERM; sleep 1; echo demo: clean exit; exit 0\" TERM" \
+        "echo demo: started" "while true; do sleep 1; done" > /etc/sv/demo/run
+    chmod +x /etc/sv/demo/run
+    ln -s /etc/sv/demo /etc/service/demo
+    exec /usr/local/sbin/runsvinit
+' >/dev/null
+sleep 3
+docker exec "$name" sv status demo
+docker stop "$name" >/dev/null
+code="$(docker inspect "$name" --format '{{.State.ExitCode}}')"
+logs="$(docker logs "$name" 2>&1)"
+docker rm "$name" >/dev/null
+echo "$logs"
+if [ "$code" != 0 ] || ! grep -q 'demo: clean exit' <<<"$logs"; then
+    echo "error: graceful stop failed (exit $code)" >&2
+    exit 1
+fi
+echo "== $img: ok"