cloud: push only amd64 for the operator-cloud image

[Brian-McM]

Description

Bug fix for the Calico Cloud release/CD tooling.

The cloud variant (VARIANT=cloud) builds and tags the operator-cloud image for amd64 only:
image-all, tag-images-all, and manifest creation all iterate $(VALIDARCHES), which the cloud
block pinned to amd64. But push-all iterates $(ARCHES), which was left at all four arches
(amd64 arm64 ppc64le s390x). So the post-merge CD push-all tried to push arches that were never
built, and failed:

docker push gcr.io/tigera-tesla/operator-cloud:master-arm64
tag does not exist: gcr.io/tigera-tesla/operator-cloud:master-arm64
make: *** [Makefile:213: sub-single-push-gcr.io___] Error 1

Fix: constrain ARCHES:=amd64 in the cloud block instead of only VALIDARCHES. VALIDARCHES
derives from ARCHES, so every image target — build, tag, push, manifest — now agrees on amd64.
The change is inside the ifeq ($(VARIANT),cloud) block, so enterprise/OSS builds are unaffected.

Testing — verified target expansion with make -pn:

Target	Enterprise	Cloud
push-all	sub-push-amd64 sub-push-arm64 sub-push-ppc64le sub-push-s390x	sub-push-amd64
tag-images-all	all four	sub-tag-images-amd64

Enterprise expansion is unchanged; cloud push-all now matches what actually gets built.

Components affected: build/release tooling (Makefile) for the Calico Cloud operator image only.

Follow-up to #4980 (the cloud un-fork), which introduced the cloud variant.

Release Note

NONE

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.

[caseydavenport]

over-commented, but otherwise LGTM