Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@libs/simdvec/native/build_cross_toolchain_image.sh`:
- Around line 24-26: The script currently only recognizes "--local" by checking
"$1" and leaves typos to proceed to the docker push logic; change argument
parsing so any non-empty, non-"--local" argument causes an immediate error and
exit (fail-closed). Specifically, validate "$1" at the top where LOCAL is set:
if "$1" is empty allow normal behavior, if "$1" == "--local" set LOCAL=true,
else print a clear usage/error and exit 1; also apply the same strict check to
the later argument-handling region that controls the docker push (the block
referencing LOCAL and the docker push commands) so unknown args cannot fall
through to the push. Ensure the error message references the accepted flag
("--local") and that the exit code is non-zero.

In `@libs/simdvec/native/Dockerfile.cross-toolchain`:
- Around line 21-44: The Dockerfile currently leaves the container running as
root after package installation; to fix, after the package-installing RUN that
ends with "rm -rf /var/lib/apt/lists/*" add steps to create a non-root user and
group (e.g., "simdvec" or "builder"), create a home directory, set appropriate
ownership of relevant workspace/build directories, set HOME and any required
environment variables, and switch to that user with the USER instruction before
the image is finalized; locate these changes around the package installation RUN
block in Dockerfile.cross-toolchain and ensure subsequent build steps run as the
non-root user.

In `@libs/simdvec/native/publish_vec_binaries.sh`:
- Line 72: The curl upload command that pipes the zip archive into curl (the
line containing: (cd "$TEMP" && zip -rq - .) | curl -sS -X PUT -H
"X-JFrog-Art-Api: ${ARTIFACTORY_API_KEY}" --data-binary `@-` --location
"${ARTIFACTORY_REPOSITORY}/org/elasticsearch/vec/${VERSION}/vec-${VERSION}.zip")
should include the --fail flag so HTTP errors cause a non‑zero exit; update that
curl invocation to add --fail (e.g., curl -sS --fail -X PUT ...) so failures are
detected and the script exits appropriately.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@libs/simdvec/native/publish_vec_binaries.sh`:
- Around line 42-45: The publish script sets TOOLCHAIN_IMAGE to
docker.elastic.co/es-dev/es-native-cross-toolchain:1 which mismatches the image
published by build_cross_toolchain_image.sh
(docker.elastic.co/elasticsearch-infra/es-native-cross-toolchain:1) and can
break pulls; update the TOOLCHAIN_IMAGE assignment in publish_vec_binaries.sh to
use the exact published repository name
docker.elastic.co/elasticsearch-infra/es-native-cross-toolchain:1 (keeping the
existing LOCAL override behavior), or centralize the image name into a shared
constant so both publish_vec_binaries.sh (TOOLCHAIN_IMAGE) and
build_cross_toolchain_image.sh reference the same canonical image name.