Two release builds side by side on one machine each take twice as long, and production only needs amd64. publish-amd64 now pushes :<version> as soon as the amd64 build is done; publish-arm64 builds arm64 afterwards, then replaces :<version> with the two-platform index and moves :latest. Both jobs use one named BuildKit builder whose container outlives the job, so the dependency layer (cargo chef cook) is reused until the dependencies change. The release is created after amd64; the binaries are attached once arm64 is in.