build: add runtime shells and publish consensus images

[littlehand26]

Summary

• Add Bash, sh and coreutils to both release images using Debian 12 slim and libstdc++6. Preserve the existing certificate bundle, application source/build flags, UID/GID 999 and direct binary entrypoints.
• Extend the existing build/release workflows to publish native amd64/arm64 execution and consensus images. Execution remains arc-node with the identical arc-writer alias; consensus is published separately as arc-consensus.
• Add runtime dependency smoke checks after the exact commit-SHA version check. Publish multi-architecture tags only after all four builds and checks succeed.

Why

The Kubernetes init and runmode launchers invoke bash and coreutils. The former distroless runtime cannot execute these launchers. An init container with a shell does not provide that shell to the independent execution/consensus containers.

Validation

• actionlint v1.7.7, bash syntax and git diff checks passed.
• YAML/matrix checks passed: build/release jobs remain identical, four native build combinations map to the correct repositories, and only the two existing workflows remain.
• Both Dockerfiles' runtime-base targets built on amd64. For this isolated check, the chef certificate source was replaced with the existing release image, without recompiling Rust.
• Repackaged the existing execution v0.8.0-ct.1 and upstream consensus v0.8.0 binaries onto the new runtimes: default UID/GID 999, certificate presence, Bash/sh/coreutils, idempotent discovery-key removal preserving another file, runmode conditional/marker operations, tail termination/wait, and exec --version all passed.
• These smoke tests use temporary paths and no node data volumes. They do not validate production volume permissions or root-level maintenance-marker permissions. Full source builds and arm64 runtime checks are performed by this PR's CI; the local repackaging check is not a substitute.

The new public ECR repository chaintable/arc-consensus has been provisioned with approval. No Rust/Cargo changes, upstream upgrade, old-tag replacement, release publication, or production deployment is included. Local fixture and operational records are excluded from this PR.