[SandObserver]

Summary

• Split the pre-push scan into per-platform build-and-scan pairs and add linux/arm64, built under the QEMU the job already sets up.
• Give each scan build its own tag (stackyard:scan-amd64, stackyard:scan-arm64) and write both to the GHA layer cache, so the push step still rebuilds from cache.
• Replace the single-platform assertions in release-workflow.test.js with a check that the platforms in the push and the platforms that get scanned are the same set, and that both scans fail the job on a HIGH or CRITICAL finding.
• Correct docs/security.md, which stated that arm64 could not be scanned before it is pushed.

Testing
All green, apart from the Docker build smoke test, which needs a local Docker daemon. The release workflow itself only runs on a tag, so the added coverage is in release-workflow.test.js: every published platform must have a build-and-scan pair ahead of the push.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.
• CHANGELOG.md updated under Unreleased if the change is user-visible.