ci: harden release discovery and snapshot builds

[DariuszPorowski]

Summary

Add the first hardening bundle from the GoReleaser stack follow-up plan as a dependent layer above #12956: items 3 and 6, plus the CLI snapshot-isolation portion of item 5. The image-scanner digest pin remains deferred until after the first RC/final cycle, as planned.

• Discover tag-build runs for five minutes with ten-second polls, reserve twelve minutes for the tag job, and provide an exact manual-dispatch recovery command on timeout.
• Disable remote Go license enrichment and Syft update checks for snapshot CLI SBOMs while preserving --enrich golang for releases.
• Retain only the Bicep tar as bicep-image-<version> in the image-export job. Core images remain available in core-snapshot-images-<sha>.

Reason for change

Avoid false controller failures when GitHub schedules tag builds slowly, remove the Go module proxy from snapshot SBOM generation, and stop uploading the same core images twice. Keep this follow-up isolated from the eighteen existing stack layers and leave release identity policy and image-attestation generation unchanged.

How to test

Passed locally:

node --test .github/scripts/dispatch-release-controller_test.mjs
bash .github/scripts/release-controller_test.sh
bash .github/scripts/release-sboms_test.sh
bash .github/scripts/verify-goreleaser-snapshot_test.sh
bash .github/scripts/release-cutover_test.sh
make goreleaser-check

The dispatcher suite passes 7 tests, controller contracts pass 41 checks, and cutover contracts pass 11 tests. The SBOM suite covers snapshot, explicit release, unset snapshot mode, paths with spaces, distribution-directory execution, and scanner exit-code propagation.

Also passed a real GoReleaser/Syft snapshot smoke test using a disposable one-binary Go-module fixture inside an isolated network namespace with GOPROXY=http://127.0.0.1:1. The generated SPDX SBOM includes the fixture's module dependency.

Markdown lint/table checks, JavaScript formatting, and wrapper/test shell formatting pass. Actionlint passes with only its known unsupported existing concurrency.queue diagnostic excluded; no repository lint suppression was added.

Full multi-architecture Docker builds and cspell were not run locally because those tools are unavailable in the validation environment. CI still needs to validate the full workflows.

File change summary

File	Summary of change
.github/scripts/dispatch-release-controller.mjs	Extend discovery and add actionable timeout recovery.
.github/scripts/dispatch-release-controller_test.mjs	Cover delayed push/manual runs and the bounded timeout.
.github/scripts/release-controller_test.sh	Assert the expanded tag-job timeout.
.github/scripts/release-cutover_test.sh	Reject duplicate core-image uploads from the export job.
.github/scripts/release-sboms_test.sh	Exercise snapshot/release wrapper behavior and scanner failures.
.github/scripts/verify-goreleaser-snapshot.sh	Validate the snapshot-aware SBOM command contract.
.github/workflows/__build-images.yaml	Upload only the Bicep tar under its dedicated artifact name.
.github/workflows/__release-controller.yaml	Increase the tag-job timeout to twelve minutes.
.goreleaser.yaml	Invoke the wrapper and explicitly pass snapshot mode.
build/scripts/goreleaser-sbom.sh	Isolate snapshot scans while retaining release enrichment.
docs/contributing/contributing-code/contributing-code-building/README.md	Document artifact names and snapshot SBOM behavior.
eng/design-notes/tools/2026-09-goreleaser-stack-review/follow-up-plan.md	Record the completed bundle and deferred scanner pin.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None