The build scripts hardcoded `docker` as the container runtime. This adds
auto-detection of docker or podman (preferring docker), with a
CONTAINER_CMD env var override.
On non-x86_64 hosts (e.g. Apple Silicon), podman/buildah ignores
--build-arg overrides for the BUILDPLATFORM predefined arg, so the
Dockerfile is patched in the build context to hardcode linux/amd64,
ensuring the correct base image is pulled for cross-compilation.