REFACTOR(build): use native ARM64 runner

- Switch from ubuntu-latest to ubuntu-24.04-arm
- Remove QEMU emulation (not needed with native ARM)
- Use CR_PAT instead of GITHUB_TOKEN for ghcr.io access

.github/workflows/build.yml

@@ -13,7 +13,7 @@ env:
 
 jobs:
   build-and-push:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04-arm
     permissions:
       contents: write
       packages: write
@@ -26,9 +26,6 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -37,7 +34,7 @@ jobs:
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.CR_PAT }}
 
       - name: Lowercase repository name
         id: lowercase

deploy/k8s/overlays/prod/kustomization.yaml

@@ -16,5 +16,5 @@ commonLabels:
 images:
   - name: ghcr.io/mayne0213/mas
     newName: ghcr.io/mayne0213/mas
-    newTag: latest
+    newTag: main-sha-1aaab71aeeb87c4018501ab4233bbce11aff1871