fix: select staging runtime image digest

Resolve the linux amd64 descriptor from multi-entry ACR manifests so staging migration and deployment pin the runtime image correctly.

frontend/tests/staging-backend-workflows.test.ts

@@ -212,10 +212,11 @@ test("staging owns its deployment control plane independently from main", () =>
   }
 });
 
-test("Gitea staging digest resolution accepts single-platform manifest arrays", () => {
+test("Gitea staging digest resolution selects linux amd64 from manifest arrays", () => {
   for (const workflow of [read(giteaDeployWorkflow), read(giteaMigrationWorkflow)]) {
-    assert.match(workflow, /d=d\[0\] if isinstance\(d,list\) and len\(d\)==1 else d/);
-    assert.match(workflow, /if isinstance\(d,dict\) else ""/);
+    assert.match(workflow, /xs=d if isinstance\(d,list\) else \[d\]/);
+    assert.match(workflow, /get\("os"\)=="linux"/);
+    assert.match(workflow, /get\("architecture"\)=="amd64"/);
   }
 });