fix: address review findings on the conventions branch

- ci: reject a manual dispatch with tag "latest"; concurrency group per tag
- Dockerfile: declare GIT_COMMIT after the module download layer
- Makefile: docker-build targets linux/amd64 by default
- patch.go: no shared package-level pointers; main.go: no init()
- tests: assert that merge replaces managed listener content
- docs: flows.md startup section matches main.go; review saved to docs/reviews

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Makefile

@@ -1,6 +1,8 @@
 BINARY  := manager
 BIN_DIR := bin
 IMG     ?= gateway-cert-operator:dev
+# The cluster is amd64; without this an Apple Silicon host builds arm64.
+PLATFORM ?= linux/amd64
 
 # GIT_COMMIT is baked into the image (-ldflags in the Dockerfile); -dirty
 # covers staged and untracked changes too, which `git diff --quiet` misses.
@@ -8,7 +10,7 @@ GIT_COMMIT ?= $(shell git rev-parse --short=12 HEAD 2>/dev/null || echo unknown)
 
 # golangci-lint type-checks the standard library of whatever toolchain is active,
 # and fails on one newer than the Go it was built with. Linting with the go.mod
-# version keeps it working when the host Go is ahead, and matches CI.
+# version keeps it working when the host Go is ahead.
 GO_MOD_VERSION := $(shell awk '$$1 == "go" {print $$2}' go.mod)
 
 .PHONY: all build run test test-short lint vet fmt tidy check docker-build clean help
@@ -43,7 +45,7 @@ tidy: ## Tidy go.mod and go.sum
 check: lint vet test-short ## Run all quality checks (lint + vet + test-short)
 
 docker-build: ## Build the container image (IMG=name:tag)
-	docker build --build-arg GIT_COMMIT=$(GIT_COMMIT) -t $(IMG) .
+	docker build --platform $(PLATFORM) --build-arg GIT_COMMIT=$(GIT_COMMIT) -t $(IMG) .
 
 clean: ## Remove build artifacts
 	rm -rf $(BIN_DIR)