ci: fix ambiguous tag-sets

In a few places the tag-set specification for jobs could match either amd64 or arm64 runners. That non-determinism is bad, especially when passing platform-specific artifacts around.

This is just a stop-gap measure. Later we'll need to rethink our CI in terms of the two platforms.

I didn't touch tag-sets with condor, as that will probably always be just a single machine (which coordinates scheduling on others).