Run CLI Docker validation on native architectures and publish tested images

src/apps/cli/Dockerfile

@@ -50,7 +50,8 @@
 #  Stage 1 — builder
 #  Full Node.js environment to compile native modules and bundle the CLI.
 # ─────────────────────────────────────────────────────────────────────────────
-FROM node:22-slim AS builder
+ARG CLI_BUNDLE_STAGE=builder
+FROM --platform=$BUILDPLATFORM node:22-slim AS builder
 
 # Build tools required by native Node.js addons (mainly leveldown)
 RUN apt-get update \
@@ -67,8 +68,14 @@ RUN npm install
 COPY . .
 RUN cd src/apps/cli && npm run build
 
+# CI may provide a prebuilt bundle in the build context.
+FROM scratch AS prebuilt
+COPY _cli-bundle/ /build/src/apps/cli/dist/
+
+FROM ${CLI_BUNDLE_STAGE} AS cli-bundle
+
 # ─────────────────────────────────────────────────────────────────────────────
-#  Stage 2 — runtime-deps
+#  Stage 4 — runtime-deps
 #  Install only the external (unbundled) packages that the CLI requires at
 #  runtime.  Native addons are compiled here against the same base image that
 #  the final runtime stage uses.
@@ -89,7 +96,7 @@ RUN npm pkg delete devDependencies \
     && npm install --omit=dev
 
 # ─────────────────────────────────────────────────────────────────────────────
-#  Stage 3 — runtime
+#  Stage 5 — runtime
 #  Minimal image: pre-compiled native modules + CLI bundle only.
 #  No build tools are included, keeping the image small.
 # ─────────────────────────────────────────────────────────────────────────────
@@ -100,8 +107,8 @@ WORKDIR /app
 # Copy pre-compiled external node_modules from runtime-deps stage
 COPY --from=runtime-deps /deps/node_modules ./node_modules
 
-# Copy the built CLI bundle from builder stage
-COPY --from=builder /build/src/apps/cli/dist ./dist
+# Copy the built CLI bundle from the selected stage
+COPY --from=cli-bundle /build/src/apps/cli/dist ./dist
 
 # Install the entrypoint wrapper with a deterministic mode, regardless of
 # source checkout permissions.

src/apps/cli/Dockerfile.publish

@@ -0,0 +1,3 @@
+# syntax=docker/dockerfile:1
+# Export the image which passed Docker E2E without rebuilding its dependencies.
+FROM validated-image

src/apps/cli/testdeno/test_dev_deno.md

@@ -327,7 +327,7 @@ The GitHub Actions workflow `.github/workflows/cli-deno-tests.yml` runs automati
 
 The separate `.github/workflows/cli-p2p-tests.yml` workflow runs the canonical Compose P2P suite automatically for changes to the CLI, its shared runtime inputs, or `test/bench-network/`. A change confined to the Compose fixtures does not start the non-P2P matrix. Host-direct `test:p2p` tasks remain available for explicit diagnostics.
 
-The `.github/workflows/cli-docker-validation.yml` workflow tests the production Docker image on relevant pull requests and is also called before container publication. Validation runs without registry credentials. The publishing workflow, `.github/workflows/cli-docker.yml`, reuses the Docker build cache and retains the existing main-branch, release-tag, and manual publication conditions.
+The `.github/workflows/cli-docker-validation.yml` workflow builds one production JavaScript bundle with Node.js 22, then tests Docker images in parallel on native amd64 and arm64 runners. Each image uses the shared bundle and prepares its own runtime dependencies. Validation runs without registry credentials, and both architecture results are collected before publication. The publishing workflow, `.github/workflows/cli-docker.yml`, imports the validated OCI image from each architecture, collects the image digests, and publishes the combined manifest. It retains the existing publication conditions for main, release tags, and manual dispatch. A dry run builds both images and checks the digest pair while skipping registry uploads and manifest publication.
 
 ---