fix: normalize default arm64 v8 image platform

internal/api/images_policy.go

@@ -42,6 +42,12 @@ func (im inspectedImage) platform() string {
 		return ""
 	}
 	p := im.Os + "/" + im.Architecture
+	// Docker can report the default ARM64 variant explicitly. Keep its
+	// identity consistent with build records and admission keys; preserve
+	// all other variants so incompatible images remain rejected.
+	if im.Architecture == "arm64" && im.Variant == "v8" {
+		return p
+	}
 	if im.Variant != "" {
 		p += "/" + im.Variant
 	}