Fix failing multi-arch runs; sync reliability fixes from upstream

[IllusoryKitsune]

Summary

Post-merge of #1, the build from source workflow failed on master (run #9) for every architecture:

• amd64, arm64/v8, riscv64 — failed to push ghcr.io/illusorykitsune/protonmail-bridge-docker:build by digest
• arm/v7 — make build-nogui vault-editor compile failure

This PR unbreaks the master-branch build and brings in the non-controversial upstream reliability fixes that were missing.

Root causes

1. Push step is wrong. The build job specifies tags: alongside outputs: ...push-by-digest=true,...,push=true. The canonical multi-arch recipe has matrix jobs push only by digest — the merge job derives tags via docker/metadata-action and publishes them with buildx imagetools create. Four parallel jobs racing on the :build tag was being rejected by GHCR.
2. arm/v7 cross-compile breaks. Proton Bridge's CGO deps (libfido2/cbor) don't cross-compile cleanly for 32-bit ARM with the current toolchain. Upstream proton-bridge doesn't officially target armv7 either.

Changes

.github/workflows/build.yaml

• Drop linux/arm/v7 from the matrix and from the PLATFORMS env.
• Remove the tags: block from the per-platform "Build and push by digest" step (merge job still produces :build and :<version>-build).

build/Dockerfile

• Build stage: add pkg-config (CGO needs it to locate libfido2/cbor .pc files; not part of build-essential).

• Runtime stage: add libfido2-1, libcbor0.10, procps. The bridge binaries are dynamically linked against libfido2/cbor — without these in the runtime image the built binary won't launch. procps is needed for pgrep below.

• Add HEALTHCHECK so Docker/K8s can detect a crashed bridge.

  Pulled from upstream shenxn/protonmail-bridge-docker#149, #134, #128.

build/entrypoint.sh, deb/entrypoint.sh

• Clean up stale /root/.gnupg/S.gpg-agent* sockets on startup (bridge refuses to start after unclean shutdowns otherwise).

• Harden socat with fork,reuseaddr + nodelay for more reliable SMTP/IMAP forwarding.

  Pulled from upstream shenxn/protonmail-bridge-docker#134.

README.md

• Drop arm/v7 from the supported-platform list.

Upstream items intentionally not included

• #146 full build rewrite — experimental, invasive, still open upstream.
• #110 rootless support — changes defaults and volume paths; belongs in its own PR.
• #122 IPv6-only listener — dual-stack on Linux already works via default TCP-LISTEN; switching to TCP6-LISTEN breaks with net.ipv6.bindv6only=1.

Test plan

• This PR runs the test job (single-arch amd64 build + Trivy scan) and deb job — both should stay green. The Dockerfile/entrypoint changes are exercised by those builds.
• After merge, the build from source run on master should succeed on all three remaining arches (amd64, arm64/v8, riscv64) and the merge job should publish ghcr.io/illusorykitsune/protonmail-bridge-docker:build and :v3.23.1-build manifest lists.
• Smoke-test the resulting image: docker run --rm ghcr.io/illusorykitsune/protonmail-bridge-docker:build /protonmail/proton-bridge --version should print a version string (proves libfido2-1/libcbor0.10 are present at runtime).
• docker inspect --format '{{json .Config.Healthcheck}}' <image> shows the new healthcheck.

https://claude.ai/code/session_01GReisMWDRKaVU49RuzvnrL