#12033: feat(docker): add linux/riscv64 image to Docker release

## Summary Adds `linux/riscv64` as a third platform to the Docker release workflow, alongside the existing `linux/amd64` and `linux/arm64`. - **Dockerfile**: Skip Bun installation on riscv64 (no binary available); all Docker build steps already use pnpm - **Workflow**: Add QEMU-emulated `build-riscv64` job with `continue-on-error: true` so failures never block releases - **Manifest**: `create-manifest` publishes amd64+arm64 immediately; `update-manifest` adds riscv64 after it completes (guarded by digest output) - **Tag cleanup**: Per-arch jobs now only push suffixed tags (`-amd64`, `-arm64`, `-riscv64`); only the manifest jobs own the unsuffixed shared tags, eliminating a pre-existing race where the last-finishing arch job briefly overwrote them Closes #11977 ## Details The `node:22-bookworm` base image already has riscv64 variants on Docker Hub. Native dependencies (`sharp`, `esbuild`) ship riscv64 prebuilts. Optional peer dependencies (`@napi-rs/canvas`, `node-llama-cpp`) are not installed in the Docker image. Bun has no riscv64 binary, but is not used during Docker builds — all build scripts use pnpm and `OPENCLAW_PREFER_PNPM=1` is already set. The Dockerfile comment "Bun may fail on ARM/Synology architectures" already anticipates this pattern. ## Test plan - [ ] Push to fork, verify riscv64 build job triggers and completes under QEMU - [ ] Verify amd64 and arm64 builds are unaffected - [ ] Verify `create-manifest` publishes amd64+arm64 without waiting for riscv64 - [ ] Verify `update-manifest` adds riscv64 to manifest only when build succeeds - [ ] Verify `update-manifest` is skipped when riscv64 build fails (digest is empty) - [ ] Pull riscv64 image and run `node openclaw.mjs --version` <!-- greptile_comment --> <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> This PR extends the Docker release GitHub Actions workflow to build and publish a third architecture (`linux/riscv64`) alongside the existing `amd64` and `arm64` images. It adds a QEMU-emulated riscv64 build job (non-blocking via `continue-on-error`) and splits manifest publishing into two stages: an initial manifest for `amd64+arm64`, followed by an optional update step that adds `riscv64` when a digest is produced. It also changes per-arch build jobs to only push architecture-suffixed tags (e.g. `-amd64`/`-arm64`/`-riscv64`), leaving the unsuffixed shared tags to the manifest jobs to avoid tag races. <h3>Confidence Score: 4/5</h3> - This PR is largely safe to merge, with one small Dockerfile environment consistency issue to address. - Workflow changes are straightforward (new non-blocking riscv64 build and two-phase manifest publishing) and don’t alter runtime code. The only concrete issue found is the riscv64 path export for Bun even when Bun isn’t installed, which can lead to a misleading environment inside the image. - Dockerfile <!-- greptile_other_comments_section --> _{(2/5) Greptile learns from your feedback when you react with thumbs up/down!} <!-- /greptile_comment -->