fix(docker-build): skip QEMU for native builds, gate the SARIF upload

[nkg]

Two faults found while clearing red mains across the HordiaLabs consumers.

setup-qemu-action ran unconditionally. QEMU exists only to emulate a foreign
architecture, the runners are all X64, and platforms defaults to linux/amd64 --
so for most consumers the step installed binfmt handlers that nothing then used.
It cost 16m18s on one observed extractor-llm run, ahead of a build that never
needed it, on a three-runner pool where queueing is the dominant cost. Now
skipped when platforms is exactly linux/amd64. The two consumers that really
cross-build, scraper-proxy-router always and store-s3 on main, request
linux/arm64 and still get it.

The SARIF upload had no opt-out. trivy-repo.yml has carried an upload-sarif
input for exactly this since the Free-plan private repos cannot use code
scanning, but docker-build.yml uploaded unconditionally, so Upload SARIF
failed with "Advanced Security must be enabled for this repository to use code
scanning" on every push to main while the Trivy scan immediately above it
passed. A permanently red check reporting an entitlement rather than a finding.
Adds the matching input, defaulting true so nothing changes for consumers that
do have Advanced Security, and gates the SARIF generation step on it too so
nothing is produced that cannot be uploaded.

Affects the two consumers that pass run-trivy-scan: true, extractor-llm and
store-postgres; both need upload-sarif: false once this is released.

Test plan

• actionlint .github/workflows/*.yml passes.
• QEMU gate verified against every consumer: only scraper-proxy-router (linux/amd64,linux/arm64) and store-s3 (linux/amd64,linux/arm64 on main, linux/amd64 otherwise) request a non-native platform, and both still match the condition.
• SARIF gate defaults true, so this is a no-op for consumers that do not pass it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EoicTZniGXry3W7YFZBsSM