scripts: build native linux/arm64 agent images for Apple-silicon Mac nodes

Apple-silicon Mac nodes (ghost) run an arm64 Docker VM, so the amd64 images run
under Rosetta. This builds native arm64 agent images (run on an arm64 mac, no QEMU)
and loads them onto the arm64 Mac node(s). amd64 (scripts/deploy.sh) still covers
the Linux nodes + Intel Macs.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

scripts/build-arm64-agent-images.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Build NATIVE linux/arm64 agent images for Apple-silicon Mac fleet nodes (whose
+# Colima/Docker VM is arm64 — the amd64 images from scripts/deploy.sh otherwise run
+# under Rosetta). Run this on an arm64 mac so the build is native (no QEMU).
+#
+# The amd64 images (scripts/deploy.sh) still cover the Linux nodes + Intel Macs.
+# These :dev arm64 images carry the same tag and are loaded ONLY onto the arm64 Mac
+# node(s) below, so each host holds its arch-appropriate image under one name.
+#
+# Usage:        scripts/build-arm64-agent-images.sh
+# Password ssh: SSHPASS=… SSH='sshpass -e ssh' scripts/build-arm64-agent-images.sh
+set -euo pipefail
+
+MAC_NODES=${MAC_NODES:-"[email protected]"}   # arm64 Mac nodes (ghost)
+SSH=${SSH:-ssh}
+IMAGES=(agent-base agent-terminal agent-browser)
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+
+for i in "${IMAGES[@]}"; do
+  echo "→ build clawmates/$i:dev (linux/arm64, native)"
+  docker buildx build --platform linux/arm64 -t "clawmates/$i:dev" --load \
+    -f "$ROOT/images/$i/Dockerfile" "$ROOT/images/$i/"
+done
+
+for host in $MAC_NODES; do
+  for i in "${IMAGES[@]}"; do
+    printf '   %-26s → %s\n' "clawmates/$i:dev" "$host"
+    docker save "clawmates/$i:dev" | $SSH "$host" "docker load" >/dev/null
+  done
+done
+echo "✓ native arm64 agent images built + loaded"