fix: optimize Dockerfile for multi-arch builds without QEMU

Use BUILDPLATFORM for the builder stage so Go compiles natively.
When GoReleaser provides PREBUILT_BINARY, copy the pre-compiled
native binary from the platform-specific directory instead of
cross-compiling inside Docker with QEMU emulation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: stubbi

Dockerfile

@@ -1,31 +1,29 @@
 # Build the manager binary
-FROM golang:1.24-alpine AS builder
+FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.24-alpine AS builder
 ARG TARGETOS
 ARG TARGETARCH
+ARG TARGETPLATFORM
 ARG PREBUILT_BINARY
 
 WORKDIR /workspace
-# Copy the Go Modules manifests
-COPY go.mod go.mod
-COPY go.sum go.sum
-# cache deps before building and copying source so that we don't need to re-download as much
-# and so that source changes don't invalidate our downloaded layer
-RUN go mod download
 
-# Copy the go source
-COPY cmd/main.go cmd/main.go
-COPY api/ api/
-COPY internal/ internal/
+# Copy dependency files first for caching
+COPY go.mod go.sum ./
+RUN if [ -z "$PREBUILT_BINARY" ]; then go mod download; fi
 
-# Build - use prebuilt binary from GoReleaser if available
-RUN if [ -n "$PREBUILT_BINARY" ] && [ -f "$PREBUILT_BINARY" ]; then \
-      cp "$PREBUILT_BINARY" manager; \
+# Copy everything else (source code, and GoReleaser platform dirs if present)
+COPY . .
+
+# Use pre-built binary if available (GoReleaser places them in platform dirs),
+# otherwise build from source. When PREBUILT_BINARY is set, GoReleaser has
+# already cross-compiled native binaries -- no QEMU needed.
+RUN if [ -n "$PREBUILT_BINARY" ] && [ -f "${TARGETPLATFORM}/${PREBUILT_BINARY}" ]; then \
+      cp "${TARGETPLATFORM}/${PREBUILT_BINARY}" manager; \
     else \
-      CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager cmd/main.go; \
+      CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH:-amd64} go build -a -o manager cmd/main.go; \
     fi
 
-# Use distroless as minimal base image to package the manager binary
-# Refer to https://github.com/GoogleContainerTools/distroless for more details
+# Runtime stage - use distroless for minimal attack surface
 FROM gcr.io/distroless/static:nonroot
 WORKDIR /
 COPY --from=builder /workspace/manager .