Summary

• Splits the arm64 Docker smoke-test build into PR and publish paths.
• Closes build-arm64 job deterministically fails on cold cache (Azure SAS token expires mid-build) #33688 by disabling the GHA cache only for pull-request arm64 builds, where cold-cache builds can outlive the cache SAS token.

Why

• The arm64 PR build can take long enough on a cold cache for GitHub's Azure cache SAS token to expire before BuildKit finishes reading or writing type=gha cache blobs.
• Push/release builds still need the per-arch cache so the publish digest build can reuse the smoke-test layers.

Changes

• .github/workflows/docker-publish.yml: adds an uncached PR-only arm64 smoke-test build step.
• .github/workflows/docker-publish.yml: keeps the existing cached arm64 smoke-test build for non-PR publish events.

Validation

• python3 - <<'PY' ... yaml.safe_load(...) ... PY — parsed docker-publish.yml and asserted the PR arm64 step has no cache-from/cache-to, while the publish arm64 step keeps both cache settings.
• actionlint .github/workflows/docker-publish.yml was not available locally (actionlint not installed; skipped).

Scope

• In scope: arm64 Docker PR build reliability for cold GHA cache runs.
• Out of scope: changing amd64 caching, publish/release cache behavior, or switching cache backends.