bastion image: pin ipxe-builder stage to the build platform

The arm64 image build died at the iPXE compile: under podman multi-arch
builds the stage runs once per TARGET platform, and the iPXE toolchain
(gcc/perl build system) does not survive qemu-user emulation. The stage
already cross-compiles both bin-x86_64-efi and bin-arm64-efi outputs in
one pass, so it only ever needs to run natively on the build host —
FROM --platform=$BUILDPLATFORM restores the arm64 image without qemu
touching the iPXE build.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V6HNx6cyr4J4CiMGCy1wkF

bastion/Dockerfile.bastion

@@ -29,7 +29,9 @@ COPY src/modules/modules/ src/modules/modules/
 RUN pnpm build
 
 # ── Stage 1b: Build iPXE snp.efi (uses UEFI SNP protocol for ISO boot) ──
-FROM fedora:43 AS ipxe-builder
+# Pinned to the build platform: this stage cross-compiles BOTH arch outputs
+# itself, and the iPXE toolchain does not survive qemu-user emulation.
+FROM --platform=$BUILDPLATFORM fedora:43 AS ipxe-builder
 
 RUN dnf install -y git gcc make perl-interpreter xz-devel gcc-aarch64-linux-gnu && dnf clean all
 RUN git clone --depth=1 https://github.com/ipxe/ipxe.git /tmp/ipxe