Fix macOS thirdparty builds and Docker release gating

[hello-stephen]

Summary

• bump the macOS CMake pin from 3.22.1 to 3.25.3 so Arrow 24 can configure
• repair an invalid cached tsan_interface_atomic.h from the GCC GitHub mirror when gcc.gnu.org rate-limits hosted runners, verifying the expected MD5 before replacement
• let Docker image publication proceed after non-cancelled matrix failures, while verifying that the Linux x86_64 prebuilt package marker matches the expected thirdparty commit
• preserve the release update time and Doris version when recording a failed build, preventing the next scheduled run from treating it as a first release

Root cause

Scheduled run https://github.com/apache/doris-thirdparty/actions/runs/31019437034 built and uploaded both Linux packages, but both macOS jobs failed while configuring Arrow 24:

CMake 3.25 or higher is required. You are running version 3.22.1

Because update-docker required the aggregate matrix result to be successful, those macOS failures skipped Docker publication even though the required Linux x86_64 package was available. The failure handler also replaced the release note without retaining Doris Version, causing later scheduled runs to detect an empty previous version and repeat the full build.

During runtime validation, gcc.gnu.org also rate-limited GitHub hosted runners and left tsan_interface_atomic.h empty in the cached source archive. The fallback repairs only an invalid copy and verifies MD5 d72679bea167d6a513d959f5abd149dc before replacing it.

Safety

Docker publication now fails closed unless installed/_doris_thirdparty_commit_ in doris-thirdparty-prebuilt-linux-x86_64.tar.xz exactly matches the commit exported by the prerelease job. A cancelled matrix still prevents Docker publication.

Validation

Static and package checks:

• actionlint -shellcheck= .github/workflows/build.yml
• git diff --check
• downloaded and ran the official CMake 3.25.3 macOS universal package; it contains both x86_64 and arm64 binaries
• verified package SHA256 771548ed2abae17f3fd28dcfa572ba3fe9f970652a72c36c2e1aafdee93a234e against Kitware's release checksum list
• exercised the prebuilt marker extraction and equality check with a local tar.xz fixture
• exercised the GCC mirror fallback from an empty header and verified MD5 d72679bea167d6a513d959f5abd149dc

Full runtime validation:

• fork run: https://github.com/hello-stephen/doris-thirdparty/actions/runs/31074452722
• exact PR head: 04385bd40c223d3e1b5cd4753ec95b284c5b29ed
• Prerelease, macOS x86_64, macOS arm64, Linux x86_64, Linux arm64, Update Docker Image, and final Success jobs all completed successfully
• both macOS logs report cmake version 3.25.3
• Linux prebuilt provenance verified as thirdparty commit 5baf0455f1dba3e43feda73e1c0303ab0369eaf0
• isolated test image digest: sha256:6213c6455b08b4bda5f29922359732f3873023a68f6f4e8721d04c704e2b2c0f
• isolated no-AVX2 test image digest: sha256:d869af782f9bd1912c1d489db216549615df80feebd152976cf3c661721fc82e