I think this is because rpi4 can run arm64 or armhf. You may be able to get around it by specifying the arm64v8 in the tag so it does not use the manifest. If that does not work I would look to the installed docker version

Short answer: yes

Though anything else I could not say better than this guide: https://opnsense.org/get-started/

Too much enterprise hardware depends on these for them to go orphaned for very long