feat(meta): keep the matrix off arm64 for the five roles that cannot run it

An undeclared role takes whatever architecture the rotation hands it, so a
role whose image ships only linux/amd64 dies on an arm64 node with an exec
format error. The architecture sweep reported five of them; each now
declares amd64 and says why, as the pin lint requires.

The reasons carry no TODO. A TODO promises a near handle, and four of these
five have none:

  checkmk   the Raw edition exists only as the vendor's appliance image, and
            every 2.4 and 2.5 tag answers amd64, so there is nothing to pin
            to and nothing to build from
  chess     v1.0.1 is amd64, but the image is ours: its workflow now builds
            linux/amd64,linux/arm64, so the next release lifts the pin
  decidim   no arm64 tag upstream; arm64 means building the Rails
            application from source the way web-app-pretix does
  pixelfed  the official image does carry arm64 but serves FrankenPHP and
            Caddy on 8080 out of /var/www/html where this role expects nginx
            on 80 out of /var/www, so it is a rewrite, not a repin
  taiga     all four of the stack's images are amd64-only, not just the two
            the sweep happened to name

Every reason is a registry reading, not a guess: ten checkmk tags across two
minor lines, the two newest numeric tags of each taiga image, and both
pixelfed images' config blobs compared for entrypoint, command, ports and
working directory.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-checkmk/meta/services.yml

@@ -49,6 +49,9 @@ prometheus:
   shared: "{{ 'web-app-prometheus' in group_names }}"
 # nocheck: playwright-service-flag  self-provider
 checkmk:
+  # nocheck: architecture-pin  Reason: checkmk ships the Raw edition as an appliance image only, and every 2.4 and 2.5 tag of checkmk/check-mk-raw answers with a single linux/amd64 manifest, so there is nothing to pin to and nothing to build from
+  architectures:
+    - amd64
   enabled: true
   shared: true
   bond: 1

roles/web-app-chess/meta/services.yml

@@ -23,6 +23,9 @@ postgres:
   enabled: true # nocheck: dynamic-flag
   shared: "{{ 'svc-db-postgres' in group_names }}"
 chess:
+  # nocheck: architecture-pin  Reason: the published v1.0.1 of ghcr.io/kevinveenbirkenbach/fedi-chess is a single linux/amd64 manifest; its workflow now builds linux/amd64,linux/arm64, so the next release makes this declaration removable
+  architectures:
+    - amd64
   healthcheck:
     flavor: curl
   modes:

roles/web-app-decidim/meta/services.yml

@@ -27,6 +27,9 @@ postgres:
   shared: "{{ 'svc-db-postgres' in group_names }}"
   enabled: true # nocheck: dynamic-flag
 decidim:
+  # nocheck: architecture-pin  Reason: ghcr.io/decidim/decidim publishes a single linux/amd64 manifest and upstream offers no arm64 tag, so reaching arm64 means building the Rails application from source the way web-app-pretix does, which this role does not
+  architectures:
+    - amd64
   healthcheck:
     flavor: curl
     path: up

roles/web-app-pixelfed/meta/services.yml

@@ -40,6 +40,9 @@ mariadb:
   shared: "{{ 'svc-db-mariadb' in group_names }}"
 # nocheck: playwright-service-flag — self-provider
 pixelfed:
+  # nocheck: architecture-pin  Reason: zknt/pixelfed publishes a single linux/amd64 manifest; the official ghcr.io/pixelfed/pixelfed does carry arm64 but serves FrankenPHP and Caddy on 8080 out of /var/www/html where this role expects nginx on 80 out of /var/www, so adopting it is a rewrite of the role rather than a repin
+  architectures:
+    - amd64
   modes:
     compose:
       enabled: true

roles/web-app-taiga/meta/services.yml

@@ -35,6 +35,9 @@ postgres:
   enabled: true # nocheck: dynamic-flag
   shared: "{{ 'svc-db-postgres' in group_names }}"
 taiga:
+  # nocheck: architecture-pin  Reason: every tag of taiga-back, taiga-front, taiga-events and taiga-protected answers with a single linux/amd64 manifest, so arm64 would mean building all four of the stack's images from source rather than one
+  architectures:
+    - amd64
   healthcheck:
     test: ["CMD", "python", "-c", "import socket; socket.create_connection(('127.0.0.1',8000),5).close()"]
     retries: 5