Fix ARM64 Dockerfile: two-stage build from official ALARM tarball

Stage 1 (alpine/arm64) downloads the official Arch Linux ARM rootfs via
curl — Docker caches this layer so it only runs once. Stage 2 (scratch)
COPYs the extracted filesystem in, then builds OrionOS natively in that
ALARM environment.

Also fixes DisableSandbox placement (insert into [options] section via
sed, not appended to file end where it lands in [aur] and is ignored).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.dockerignore

@@ -9,3 +9,4 @@ launcher/skylauncher
 .DS_Store
 **/.DS_Store
 dist/
+iso/docker/alarm-aarch64.tar.gz