Gromit-generated output with the following changes:

- Dockerfile.distroless: parameterized with BASE_IMAGE/BASE_IMAGE_S390X
  ARGs for per-build Docker base image override. Defaults to distroless
  for std builds. EE and FIPS builds use tykio/dhi-busybox:1.37-fips.
- goreleaser.yml: added FIPS builds (amd64, arm64, s390x) using
  GOFIPS140=v1.0.0 (Go 1.24+ native FIPS 140-3 module, replacing
  the deprecated GOEXPERIMENT=boringcrypto)
- release.yml: added FIPS Docker build steps, BASE_IMAGE build-arg
  on EE builds, Go 1.25 build environment

FIPS is now a gromit feature flag — branches opt in by adding "fips"
to their features list. FIPS Docker images are built for amd64/arm64
(s390x excluded — no FIPS base image for that arch). FIPS packages
(.deb/.rpm) are built for all three architectures.

Open source (std) builds are unaffected.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>