I think this is because rpi4 can run arm64 or armhf. You may be able to get around it by specifying the arm64v8 in the tag so it does not use the manifest. If that does not work I would look to the installed docker version

used to be against terms of use for proxy, the forbidding language has been gone for a year or two now

Short answer: yes

Though anything else I could not say better than this guide: https://opnsense.org/get-started/