feat(release): publish each contextful profile as an amd64 + arm64 image index

infra/Dockerfile.sandbox-release

@@ -27,8 +27,6 @@ RUN python3 -m venv /opt/zig && \
 # Text-only TAPI records only the macOS system symbols referenced by
 # iana-time-zone. The runtime framework comes from macOS itself.
 COPY infra/darwin-stubs /opt/darwin-stubs
-COPY infra/build-oci-layer.sh /opt/build-oci-layer.sh
-COPY infra/build-oci-layout.py /opt/build-oci-layout.py
 ENV CARGO_TARGET_AARCH64_APPLE_DARWIN_RUSTFLAGS="-C link-arg=-F/opt/darwin-stubs" \
     CARGO_TARGET_X86_64_APPLE_DARWIN_RUSTFLAGS="-C link-arg=-F/opt/darwin-stubs" \
     CARGO_BUILD_JOBS=4

packages/core/src/fakes/github-fake.ts

@@ -129,7 +129,7 @@ export type GithubFakeState = {
   /** Every `createRelease` call, in order — lets a test assert a release published. */
   readonly createReleaseCalls: CreateRelease[];
   readonly publishReleaseCalls: Array<{ repo: string; releaseId: number }>;
-  readonly publishContainerImageCalls: Array<{ repo: string; profile: string; version: string }>;
+  readonly publishContainerImageCalls: Array<{ repo: string; profile: string; version: string; images: string[] }>;
   readonly releases: Record<string, ReleaseResult>;
   readonly tagCommits: Record<string, string>;
   /** Every label ADD, in order. */
@@ -536,7 +536,8 @@ export const makeGithubFake = (
         downloadUrl: `https://github.com/${req.repo}/releases/download/${req.releaseId}/${req.artifactName}`,
       }),
     publishContainerImage: (req) => Effect.sync(() => {
-      state.publishContainerImageCalls.push({ repo: req.repo, profile: req.profile, version: req.version });
+      state.publishContainerImageCalls.push({ repo: req.repo, profile: req.profile, version: req.version,
+        images: req.platforms.map((platform) => platform.imageArtifactName) });
     }),
   };
 

packages/core/src/services/github.ts

@@ -303,15 +303,20 @@ export type ReleaseAssetResult = {
   readonly downloadUrl: string;
 };
 
+/**
+ * A multi-platform release image: each platform's `.image.json` descriptor,
+ * staged by the release cell that built it, pushed as one image index under
+ * `version`.
+ */
 export type PublishContainerImage = {
   readonly repo: string;
   readonly profile: string;
   readonly version: string;
-  readonly sourceExecutionId: string;
-  readonly layerArtifactName: string;
-  readonly layerSize: number;
-  readonly layerDigest: string;
-  readonly diffId: string;
+  /** In index order, amd64 before arm64. */
+  readonly platforms: ReadonlyArray<{
+    readonly sourceExecutionId: string;
+    readonly imageArtifactName: string;
+  }>;
 };
 
 /**