ci: run pipeline natively on arm64 act runners

- runs-on: arm64 (was talos-rpi5/macOS Mac Mini)
- replace Homebrew deps with native arm64 (crane+jq static binaries)
- gmake -> make across workflows and auto-update.sh
- guard Homebrew gnu-sed PATH in Makefile for Linux
- no QEMU/binfmt — builds are native arm64
- docs: TECHNICAL.md runner setup for ASUS GX10

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/auto-update.sh

@@ -21,6 +21,9 @@ LATEST_RPI_TAG=${LATEST_RPI_TAG:-}
 MAKEFILE="Makefile"
 PATCH_FILE="patches/siderolabs/pkgs/0001-Patched-for-Raspberry-Pi-5.patch"
 
+# GNU make: `gmake` on macOS (Homebrew), `make` on the Linux arm64 runner.
+MAKE=$(command -v gmake || command -v make)
+
 # Helper: extract kernel semver (e.g. 6.12.47) from the RPi repo Makefile
 get_kernel_version() {
   local tag="$1"
@@ -81,13 +84,13 @@ fi
 
 # ── Smoke test — verify patches apply ───────────────────────────────
 echo "Running patch smoke test ..." >&2
-if ! gmake checkouts patches; then
+if ! "$MAKE" checkouts patches; then
   echo "Patches failed to apply!" >&2
-  gmake checkouts-clean >/dev/null 2>&1 || true
+  "$MAKE" checkouts-clean >/dev/null 2>&1 || true
   echo "patch_failed=true"
   exit 0
 fi
-gmake checkouts-clean >/dev/null 2>&1
+"$MAKE" checkouts-clean >/dev/null 2>&1
 
 # ── Generate tag ────────────────────────────────────────────────────
 TALOS_VER=$(grep '^TALOS_VERSION' "$MAKEFILE" | awk '{print $NF}')