fix: Reduce Docker image size by avoiding duplicate binary copies

The runtime stage was copying both amd64 and arm64 pulse binaries to /tmp/,
then selecting one based on TARGETARCH and deleting the rest. Due to Docker's
immutable layers, the deleted binaries were still counted toward image size.

Changed to copy directly using TARGETARCH variable substitution, which only
copies the needed binary for the target architecture.

This saves ~34MB per architecture in the final image.

Note: The agent_runtime stage and /opt/pulse/bin/ download binaries still have
room for optimization, but require more complex changes.

Related to #981

Dockerfile

@@ -234,15 +234,11 @@ RUN apk --no-cache add ca-certificates tzdata su-exec openssh-client
 
 WORKDIR /app
 
-# Copy all pulse binaries, then select the correct one for target architecture
-COPY --from=backend-builder /app/pulse-linux-* /tmp/
-RUN if [ "$TARGETARCH" = "arm64" ]; then \
-        cp /tmp/pulse-linux-arm64 ./pulse; \
-    else \
-        cp /tmp/pulse-linux-amd64 ./pulse; \
-    fi && \
-    chmod +x ./pulse && \
-    rm -rf /tmp/pulse-linux-*
+# Copy the correct pulse binary for target architecture directly
+# Use separate COPY commands with TARGETARCH to avoid copying both binaries
+# (copying to /tmp then deleting wastes space due to Docker layer immutability)
+COPY --from=backend-builder /app/pulse-linux-${TARGETARCH:-amd64} ./pulse
+RUN chmod +x ./pulse