Support arm64 Govard images on macOS

[tuanhaviet22]

Summary

This PR makes Govard handle Apple Silicon/macOS image workflows more reliably.

• Rebuild locally cached Govard-managed amd64 images on darwin/arm64 when the image already exists but is incompatible with the host.
• Run the rebuild check through govard up, govard env pull, and govard doctor --fix, so the fix applies even when images are present and docker compose pull does not report them as missing.
• Add DOCKER_PLATFORMS support for make images and make push, with macOS defaulting to linux/amd64,linux/arm64 and single-platform overrides still supported.
• Route image builds through a Buildx wrapper that creates/uses a docker-container builder for multi-platform builds and fails early with a clear message if the requested platform is not supported.
• Fix the PHP image entrypoint UID/GID remap flow by re-entering as root before changing www-data, then dropping back to www-data before running the final command.
• Canonicalize symlinked project paths in compose-file and project-registry paths, and stabilize macOS-specific tests around browser/trust commands and binary path resolution.

Root Cause

On Apple Silicon, Docker can have a Govard-managed image in the local cache with amd64 architecture. Because the image exists, the previous fallback path did not rebuild it, but the runtime could still be using an image that is incompatible with the host.

The PHP entrypoint also attempted to call sudo after changing the UID for www-data. At that point, the current process could be running under a numeric UID that no longer resolves in /etc/passwd, which causes sudo to fail with you do not exist in the passwd database.

For image publishing, docker buildx bake with multiple platforms fails on Docker's default docker builder. Multi-platform builds need a compatible builder such as docker-container, or a clear preflight failure when the requested platform is not available.

Implementation Notes

• FallbackBuildMissingGovardImagesFromCompose now delegates to a shared build path that can build missing images and rebuild incompatible local images.
• RebuildIncompatibleGovardImagesFromCompose inspects existing local image architecture and rebuilds Govard-managed amd64 images only on darwin/arm64.
• govard up, env pull, and doctor --fix call the incompatible-image rebuild path after compose rendering/pull handling.
• scripts/docker-buildx-bake.sh preserves the existing bake interface while selecting a multi-platform builder only when DOCKER_PLATFORMS contains more than one platform.
• The PHP entrypoint now performs UID/GID mutation from a root re-entry and only drops to www-data at the end.

Tests

• go test -count=1 ./tests
• go test -count=1 ./internal/engine ./internal/cmd
• git diff --check
• sh -n scripts/docker-buildx-bake.sh
• make -n images DOCKER_PLATFORMS=linux/amd64,linux/arm64
• make -n push DOCKER_PLATFORMS=linux/amd64,linux/arm64
• DOCKER_PLATFORMS=linux/arm64 ./scripts/docker-buildx-bake.sh -f docker/docker-bake.hcl --set "*.platform=linux/arm64" --print dnsmasq
• Verified the multi-platform Buildx wrapper fails early with a clear message on a Linux host whose builder does not advertise linux/arm64.
• Verified the PHP entrypoint in Docker with PUID=2000 and PGID=2000; the final command ran as UID 2000, and www-data resolved to UID 2000.

[ddtcorex]

Close #59