fix: link arm64 ICU when hosted image builds cross-compile

[weicao]

Summary

• Hosted 0.2.1 image builds run on amd64 and cross-link arm64. The current Dockerfile only installs host-arch ICU, so the arm64 link fails looking for libicui18n.
• This installs libicu-dev:arm64 and points the arm64 link at /usr/lib/aarch64-linux-gnu. Product code is unchanged.
• Exact signed head is 4d5c72db5473ab9cfe14b44d1e3c57b9b5b4441b on parent 68760b5a. Only docker/Dockerfile changes. Do not overwrite v0.2.0 or latest.

Test plan

• Independent review of exact head 4d5c72db (Dockerfile only, unique parent 68760b5a)
• After merge, dispatch a new unique 0.2.1-dev tag from the new main SHA
• Confirm Hub has the new tag and v0.2.0/latest digest is unchanged

Made with Cursor

[leon-ape]

Independent approval for the exact immutable candidate.

Identity locked:

• head 4d5c72d
• unique parent 68760b5
• head tree 38c864cbc1e6051558f4faa9097add3b868b1492
• commit signature verified=true, reason=valid
• one commit; exactly one changed file: docker/Dockerfile (+9/-3)
• parent blob f02e51707023a71bc5e9bb41005452a3e78590fd -> head blob b8a78984c6c50a8d0f2ce131e91b6e5cb117ab37

Technical review:

• Exact-parent Release Image run 33046906756, job 98432942419, reproduced the defect in the linux/amd64 -> arm64 builder: aarch64-linux-gnu-g++ could not find -licui18n, -licuuc, or -licudata.
• Debian bookworm arm64 libicu-dev (72.1-3+deb12u1, Multi-Arch: same) supplies /usr/lib/aarch64-linux-gnu/libicui18n.so, libicuuc.so, and libicudata.so (and the corresponding archives).
• This change enables arm64, co-installs libicu-dev and libicu-dev:arm64, and supplies CGO_LDFLAGS=-L/usr/lib/aarch64-linux-gnu only for the arm64 build. The flag precedes the emitted ICU -l flags. The runtime stage and product code are unchanged.
• The PR matrix's amd64 Docker builds complete. The remaining Go, Dolt, and Binlog red jobs are existing source/environment baselines outside this one-file change; Binlog Group 2 reproduces the parent Last_SQL_Errno 0 versus 1105 baseline. They do not validate or invalidate the arm64 release build.

No blocker found for this Dockerfile change. A fresh dual-architecture Release Image run is still required after the ordinary merge. This review does not authorize merge, dispatch, tag, or publication.

[leon-ape]

Reviewed exact signed head 4d5c72d (parent 68760b5). The one-file Dockerfile change installs libicu-dev:arm64 after enabling dpkg arm64 and adds the target triplet to CGO_LDFLAGS; Debian package metadata and an aarch64 ld -r check confirm target ICU archives/symlinks resolve, while host-only paths fail. Go cmd CGO_LDFLAGS ordering places this -L before package -l flags. Current Go/Dolt/Binlog reds match known parent baselines and are unrelated to this Dockerfile. Approval covers code review only; a real patched dual-arch Release Image build remains a post-merge gate.