Fix multi-arch support for distroless Docker image

The distroless Dockerfile was using a hardcoded SHA256 digest that
referenced only the amd64 image, preventing builds for other
architectures. This caused the main-distroless tag to only publish
amd64 images while the regular main tag had all 5 architectures.

Changes:
- Use architecture-specific image tags (nonroot-${DISTROLESS_ARCH})
  instead of SHA256 digest to enable multi-arch manifest resolution
- Add DISTROLESS_ARCH build arg to handle architecture name mapping
  (armv7 -> arm) between Prometheus and distroless conventions
- Move ARG declarations before FROM to support variable substitution

Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>

Dockerfile.distroless

@@ -1,8 +1,10 @@
-FROM gcr.io/distroless/static-debian13:nonroot@sha256:f9f84bd968430d7d35e8e6d55c40efb0b980829ec42920a49e60e65eac0d83fc
-# Base image sets USER to 65532:65532 (nonroot user).
-
 ARG ARCH="amd64"
 ARG OS="linux"
+ARG DISTROLESS_ARCH="amd64"
+
+# Use DISTROLESS_ARCH for base image selection (handles armv7->arm mapping).
+FROM gcr.io/distroless/static-debian13:nonroot-${DISTROLESS_ARCH}
+# Base image sets USER to 65532:65532 (nonroot user).
 
 LABEL org.opencontainers.image.authors="The Prometheus Authors"
 LABEL org.opencontainers.image.vendor="Prometheus"

Makefile.common

@@ -250,12 +250,17 @@ $(BUILD_DOCKER_ARCHS): common-docker-%:
 	@for variant in $(DOCKERFILE_VARIANTS_WITH_NAMES); do \
 		dockerfile=$${variant#*:}; \
 		variant_name=$${variant%%:*}; \
+		distroless_arch="$*"; \
+		if [ "$*" = "armv7" ]; then \
+			distroless_arch="arm"; \
+		fi; \
 		if [ "$$dockerfile" = "Dockerfile" ]; then \
 			echo "Building default variant ($$variant_name) for linux-$* using $$dockerfile"; \
 			docker build -t "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:$(SANITIZED_DOCKER_IMAGE_TAG)" \
 				-f $$dockerfile \
 				--build-arg ARCH="$*" \
 				--build-arg OS="linux" \
+				--build-arg DISTROLESS_ARCH="$$distroless_arch" \
 				$(DOCKERBUILD_CONTEXT); \
 			if [ "$$variant_name" != "default" ]; then \
 				echo "Tagging default variant with $$variant_name suffix"; \
@@ -268,6 +273,7 @@ $(BUILD_DOCKER_ARCHS): common-docker-%:
 				-f $$dockerfile \
 				--build-arg ARCH="$*" \
 				--build-arg OS="linux" \
+				--build-arg DISTROLESS_ARCH="$$distroless_arch" \
 				$(DOCKERBUILD_CONTEXT); \
 		fi; \
 	done