Fix a flaky arm64 check in publish-image

`! docker buildx inspect | grep -q linux/arm64` under `set -o pipefail` fails
when grep exits on its first match before buildx has finished writing: buildx
dies of SIGPIPE, the pipeline reports 141, and the script tells the operator to
register emulation that is already registered. It refused to publish twice in a
row that way, with arm64 present each time — and the same race is why it ever
worked. Matching against the captured output has no pipe to break.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/publish-image.sh

@@ -23,7 +23,13 @@ fi
 # An x86 machine builds arm64 under QEMU emulation, which has to be registered
 # once per boot. Registering needs a privileged container, so say how rather
 # than doing it unasked.
-if [[ "$PLATFORMS" == *linux/arm64* ]] && ! docker buildx inspect | grep -q 'linux/arm64'; then
+#
+# The platform list is captured, not piped into grep: `grep -q` exits on the
+# first match, buildx then dies of SIGPIPE, and under `pipefail` that reads as
+# "no arm64" — which had this script refuse to publish while arm64 was
+# available the whole time.
+platforms=$(docker buildx inspect)
+if [[ "$PLATFORMS" == *linux/arm64* ]] && [[ "$platforms" != *linux/arm64* ]]; then
 	echo "This builder cannot build linux/arm64. Register emulation (lasts until the next reboot) with:" >&2
 	echo "  docker run --privileged --rm tonistiigi/binfmt --install arm64" >&2
 	exit 1