Fix build flow: lockfile bot, CPU multi-arch, paths-ignore, release guard

- update-lockfile.yml: regenerate all four lockfiles (main + cpu/rocm/intel
  variants) on any pyproject change; add variant pyproject files to trigger
- docker-publish.yml: add lockfiles to paths-ignore so the bot commit does
  not trigger a second Docker build; remove redundant CONTRIBUTING/SECURITY
  entries already covered by **.md; add QEMU to build-cpu; set CPU image to
  linux/amd64,linux/arm64 to match release
- release.yml: inline lockfile generation now covers all variants; add
  workflow_dispatch guard that fails if not dispatched from main

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/docker-publish.yml

@@ -6,13 +6,15 @@ on:
     paths-ignore:
       - "**.md"
       - "docs/**"
-      - "CONTRIBUTING.md"
-      - "SECURITY.md"
       - ".github/ISSUE_TEMPLATE/**"
       - ".github/PULL_REQUEST_TEMPLATE.md"
       - ".github/workflows/release.yml"
       - ".github/workflows/lint.yml"
       - ".github/dependabot.yml"
+      - "uv.lock"
+      - "uv-cpu.lock"
+      - "uv-rocm.lock"
+      - "uv-intel.lock"
 
 concurrency:
   group: docker-${{ github.ref }}
@@ -143,7 +145,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   build-cpu:
-    name: Build CPU-only (amd64)
+    name: Build CPU (amd64 + arm64)
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -161,6 +163,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v6
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
@@ -185,7 +190,7 @@ jobs:
         with:
           context: .
           file: ./Dockerfile
-          platforms: linux/amd64
+          platforms: linux/amd64,linux/arm64
           build-args: VARIANT=cpu
           cache-from: type=gha,scope=linux/amd64-cpu
           cache-to: type=gha,mode=max,scope=linux/amd64-cpu