fix: support remote arm64 builds, as well (#9018)

.github/workflows/Dockerfile.bazel

@@ -4,7 +4,7 @@ FROM ubuntu:24.04
 # initial debugging, but we should publish to a more proper location.
 #
 # docker buildx create --use
-# docker buildx build --platform linux/amd64 -f .github/workflows/Dockerfile.bazel -t mbolin491/codex-bazel:latest --push .
+# docker buildx build --platform linux/amd64,linux/arm64 -f .github/workflows/Dockerfile.bazel -t mbolin491/codex-bazel:latest --push .
 
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \

.github/workflows/bazel.yml

@@ -108,24 +108,3 @@ jobs:
             --build_metadata=ROLE=CI \
             --build_metadata=VISIBILITY=PUBLIC \
             "--remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY"
-
-  cloud-build:
-    name: just bazel-remote-test
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - name: Set up Bazel
-        uses: bazelbuild/setup-bazelisk@v3
-      - name: bazel test //... --config=remote
-        env:
-          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          bazel test //... \
-            --build_metadata=REPO_URL=https://github.com/openai/codex.git \
-            --build_metadata=COMMIT_SHA=$(git rev-parse HEAD) \
-            --build_metadata=ROLE=CI \
-            --build_metadata=VISIBILITY=PUBLIC \
-            "--remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY" \
-            --config=remote --platforms=//:rbe --keep_going

.github/workflows/ci.bazelrc

@@ -2,14 +2,19 @@ common --remote_download_minimal
 common --nobuild_runfile_links
 common --keep_going
 
-# Prefer to run the build actions entirely remotely so we can dial up the concurrency.
-# Currently remote builds only work on Mac hosts, until we untangle the libc constraints mess on linux.
+# We prefer to run the build actions entirely remotely so we can dial up the concurrency.
+# We have platform-specific tests, so we want to execute the tests on all platforms using the strongest sandboxing available on each platform.
+
+# On linux, we can do a full remote build/test, by targeting the right (x86/arm) runners, so we have coverage of both.
+# Linux crossbuilds don't work until we untangle the libc constraint mess.
+common:linux --config=remote
+common:linux --strategy=remote
+common:linux --platforms=//:rbe
+
+# On mac, we can run all the build actions remotely but test actions locally.
 common:macos --config=remote
 common:macos --strategy=remote
-
-# We have platform-specific tests, so execute the tests locally using the strongest sandboxing available on each platform.
 common:macos --strategy=TestRunner=darwin-sandbox,local
-# Note: linux-sandbox is stronger, but not available in GHA.
-common:linux --strategy=TestRunner=processwrapper-sandbox,local
+
 common:windows --strategy=TestRunner=local