Stage 1 (alpine/arm64) downloads the official Arch Linux ARM rootfs via
curl — Docker caches this layer so it only runs once. Stage 2 (scratch)
COPYs the extracted filesystem in, then builds OrionOS natively in that
ALARM environment.
Also fixes DisableSandbox placement (insert into [options] section via
sed, not appended to file end where it lands in [aur] and is ignored).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>