ci(pi-gen): install qemu-user-static via apt instead of setup-qemu-action

docker/setup-qemu-action registers binfmt via a privileged side container;
pi-gen-action's own nested Docker container doesn't inherit the
registration. Result: arm64 ELFs in the pi-gen chroot still fail to
exec, exit 1 before any stage runs.

apt-installed qemu-user-static + binfmt-support writes persistent
binfmt_misc entries to the kernel that propagate to every container
share. Pair with update-binfmts --enable qemu-aarch64 and a sanity
ls -la /proc/sys/fs/binfmt_misc/qemu-aarch64.

.github/workflows/build.yml

@@ -169,12 +169,18 @@ jobs:
           chmod +x deploy/pi-gen/stage-betterframe-client/01-install-kiosk/00-run-chroot.sh
 
       # x86 runner can't natively execute the arm64 binaries pi-gen drops
-      # into the chroot. Register QEMU binfmt_misc handlers so the chroot's
-      # arm64 dpkg / apt-get / etc work transparently.
+      # into the chroot. Install qemu-user-static + binfmt-support so the
+      # kernel routes arm64 ELFs through QEMU. docker/setup-qemu-action
+      # registers via a privileged container which pi-gen's own nested
+      # container doesn't pick up — apt path is what pi-gen documents.
       - name: Register QEMU binfmt for arm64
-        uses: docker/setup-qemu-action@v4
-        with:
-          platforms: arm64
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            qemu-user-static binfmt-support
+          sudo update-binfmts --enable qemu-aarch64
+          # Sanity check — pi-gen looks for this exact file.
+          ls -la /proc/sys/fs/binfmt_misc/qemu-aarch64
 
       - name: Build Pi image (pi-gen)
         uses: usimd/pi-gen-action@v1