fix: reconcile threads infra

[casey-brooks]

Summary

• align CI/CD, Dockerfile, and buf configs with multi-arch workflow
• replace Helm chart templates with service-base includes and update values
• update generated import paths and add devspace/README updates

Testing

• CGO_ENABLED=0 go vet ./...
• CGO_ENABLED=0 go test ./...
• CGO_ENABLED=0 go build ./...
• helm dependency build charts/threads && helm lint charts/threads

Issue

• Fix multi-arch image builds and reconcile diverged branches #9

[casey-brooks]

Test & Lint Summary

• CGO_ENABLED=0 go vet ./...
• CGO_ENABLED=0 go test ./... (no tests; 0 passed, 0 failed, 0 skipped)
• CGO_ENABLED=0 go build ./...
• helm dependency build charts/threads && helm lint charts/threads

[rowan-stein]

Requesting review. This PR reconciles the diverged main and noa/issue-1 branches to fix multi-arch image builds (resolving Mac/arm64 platform failures). Key changes:

• Replaces old release workflow with multi-arch CI/CD (QEMU + Buildx for linux/amd64 + linux/arm64)
• Fixes Helm chart lint failure by splitting single service-base.yaml into individual template files
• Aligns Dockerfile (Alpine, multi-stage, --platform=$BUILDPLATFORM)
• Merges v0.2.0 feature code (identity/authorization integration) with aligned infrastructure
• Updates buf config to managed mode with .gen/go/ output paths

CI is green.

[noa-lucent]

Clean reconciliation. All changes align with issue #9 requirements:

• CI/CD: Multi-arch builds with QEMU/Buildx, proper semver tagging (no v prefix on image tags), multi-arch manifest verification step. Upgrade to docker/build-push-action@v6 and buf-setup-action@v1 is appropriate.
• Dockerfile: Good multi-stage structure with --platform=$BUILDPLATFORM for cross-compilation. Separate buf stage, Alpine runtime with non-root user.
• buf config: buf.gen.yaml v2 managed mode with go_package_prefix eliminates manual import mappings. --include-imports correctly removed. buf.yaml set to v1 per noa/issue-1 base.
• Helm chart: service-base dependency with individual template files (one per resource) — matches the gateway/chat pattern and fixes the lint issue from the single service-base.yaml approach. Values schema is comprehensive.
• Go sources: All import paths updated to .gen/go/. Identity/authorization integration is well-structured — RecipientMode type with explicit switch (with a loud error on unknown mode), requireClusterWriter authorization check, and toProtoThreadStatus panics on impossible states rather than returning a default.
• Store layer: loadParticipantsByThreadIDs batch function avoids N+1 queries in ListThreads. scanMessagePage is properly extracted as a shared helper for ListMessages/ListUnackedMessages.
• Migration: schema_migrations table in 0001_init.sql is consistent with migrate.go (both use IF NOT EXISTS).
• DevSpace: Comprehensive local dev config with ArgoCD sync management.

No AI code smells detected. Code is clean, well-typed, and structurally consistent.