Fix updater PostgreSQL client version

[arjunkomath]

What changed

• use a client-only Alpine 3.23 runtime for the control-plane updater
• install PostgreSQL 18 client tools explicitly so pg_dump matches the bundled PostgreSQL server
• preserve the pinned Docker 28 CLI and Compose plugin without inheriting the PostgreSQL server image
• build the updater image for both AMD64 and ARM64 in CI

Why

Control-plane updates failed during the required pre-upgrade database backup. The bundled server was PostgreSQL 18.4, while the updater image installed pg_dump 17.10 through Alpine's unversioned postgresql-client package. PostgreSQL rejects dumps when the client is older than the server, so the updater aborted before deploying the target version.

Impact

Database backups can run against the bundled PostgreSQL 18 server, allowing updates to proceed. The updater remains a client-only image and does not inherit PostgreSQL server volumes, ports, entrypoints, or stop behavior.

Validation

• go test ./...
• go vet ./...
• workflow YAML validation
• git diff --check
• updater image builds for AMD64 and ARM64
• PostgreSQL client reports 18.4 on both architectures
• updater health endpoint returned {"ok":true} on both architectures