build: target amd64 — Google ships no arm64 Linux build-tools

The image pinned build-tools 36.0.0, whose aapt2/d8 are x86_64-only (Google
publishes no arm64 Linux build-tools). Built for and run on arm64, packaging
died with `aapt2: Syntax error: newline unexpected` (an x86_64 binary the
kernel can't exec).

Build the image for linux/amd64 on an amd64 runner, and point the template +
README at ubuntu-24.04. The APK output is architecture-neutral, so this costs
nothing downstream. Also execute aapt2 in the image sanity check so an arch
mismatch fails the image build, not every app build.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -1,18 +1,23 @@
 # android-builder
 
-Native `linux/arm64` Android build toolchain for CI, published to the Gitea
+Native `linux/amd64` Android build toolchain for CI, published to the Gitea
 container registry at `git.helu.ca/r/android`.
 
 App repos consume this image to build signed release artifacts. Instrumented
 tests are **not** part of this toolchain — by design, CI builds are promotions
 of code already tested in Dev (on Apple silicon, where the emulator runs
-natively). The OCI Ampere (aarch64) runner has no `/dev/kvm` (the guest VM
-boots at EL1, so KVM can't access HYP/EL2), so there's no accelerated emulator
-here — and we don't need one.
+natively).
+
+**Why amd64:** Google publishes the Linux Android build-tools (`aapt2`, `d8`,
+…) for **x86_64 only** — there is no arm64 Linux build-tools package. Running
+the toolchain on an aarch64 runner fails at resource packaging
+(`aapt2: Syntax error: newline unexpected`, an x86_64 binary the kernel can't
+exec). The produced APK/AAB is architecture-neutral regardless of build host,
+so building on amd64 costs nothing on the output side.
 
 ## What's in the image
 
-- Eclipse Temurin JDK 21 (native arm64)
+- Eclipse Temurin JDK 21 (native amd64)
 - Android cmdline-tools, platform, and build-tools — **baked in**, so prod
   builds don't depend on Google's download endpoint at job time
 - `git`, `curl`, `unzip`
@@ -27,8 +32,8 @@ Pinned versions live as `ARG`s at the top of the `Dockerfile`:
 | `BUILD_TOOLS_VERSION`   | `36.0.0`    | SDK Manager / release notes |
 | `PLATFORM_VERSION`      | `android-36`| your app's `compileSdk` |
 
-`aapt2` and the build-tools binaries ship native arm64 for 36.x, so packaging
-runs without emulation.
+The build-tools binaries (`aapt2`, `d8`) are x86_64 ELF — this is why the
+image is amd64 (see "Why amd64" above).
 
 ## Tagging model
 
@@ -63,7 +68,7 @@ app and pin the toolchain:
 ```yaml
 jobs:
   build:
-    runs-on: ubuntu-24.04-arm64
+    runs-on: ubuntu-24.04
     container:
       image: git.helu.ca/r/android:2026.06
       credentials: