release-26.1: migrate release pipelines from TeamCity to GitHub Actions

[rail]

Backport 1/1 commits from #170298 on behalf of @rail.

---

Move the release build/sign, publish, branch-cut, and pick-SHA pipelines
from TeamCity-driven workflows to GitHub Actions, while preserving the
existing TC shell scripts as the underlying build steps.

New GitHub Actions workflows under .github/workflows/:

• release-build-and-sign.yml — per-platform builds (linux amd64/arm64,
  s390x, FIPS, darwin amd64/arm64, windows), Docker multi-arch image
  builds, macOS notarization, IBM/GPG signing, sentry release upload,
  and Slack notification. Concurrency-grouped, per-job timeouts, all
  third-party actions pinned to commit SHAs, secrets fetched from GCP
  Secret Manager via WIF (no GitHub repo secrets), umask-restricted
  on-disk secret materialization. rcodesign installed from a SHA-pinned
  upstream binary into $RUNNER_TEMP/bin (no cargo, no sudo).
• release-publish.yml — promotes staged artifacts to DockerHub, the
  Red Hat container catalog, and opens RAFA cloud-rollout PRs. A
  single approve-publish job hosts the release-ops environment so the
  reviewer clicks approve once per dispatch and every downstream
  publish job inherits the gate transitively.
• release-branch-cut.yml — cuts staging branches, files Jira tickets
  (ADF-rendered), creates the backport label, and posts to Slack.
• release-pick-sha.yml — picks a release SHA, writes it back to the
  Jira ticket, dispatches release-build-and-sign, and notifies the
  docs release-notes API.

Both build-and-sign and publish accept a comma-separated skip_jobs
input (validated by a first-stage validate-skip-jobs job) so an
operator can re-dispatch after a partial infra failure without re-
running already-successful jobs. Downstream jobs honor a 'skipped'
upstream as success-equivalent only when the upstream is explicitly
in skip_jobs, so cascade-skips from real failures don't masquerade as
successful resumes.

Companion build/github/release-*.sh wrappers translate GHA env
conventions to the existing build/teamcity/internal/release/...
scripts, which gain conditional WIF auth and dev-vs-prod GCS / Artifact
Registry project selection so they can be invoked from either driver.
TC code paths in every shared script are untouched. Branch-cut and
pick-SHA additionally build and run their release binary inside the
bazel docker container (via run_bazel) so the host runner doesn't
need a bazel/Go toolchain installed. The wrappers forward
GITHUB_REPOSITORY into the container so the binary's defaultRepo()
helper picks up the dispatching repo instead of falling back to
cockroachdb/cockroach.

A new pkg/cmd/release Go CLI drives the branch-cut and pick-SHA
workflows. It includes Jira (REST v3 + ADF), GitHub, Slack, and docs
release-notes API clients, with unit tests for the SHA-pick and
branch-cut commands. All HTTP clients are bounded by named per-call
timeouts via httputil.NewClientWithTimeout so a wedged upstream API
can't hang the cron run. update-versions takes --cockroach-repo and
--github-username flags so the push targets aren't bound to specific
literals; the dry-run override fires on isProductionRepo() rather
than matching a hardcoded repo name, so a future prod-repo rename is
a zero-line code change in the binary. Per-ticket summary logs in the
branch-cut runner are dry-run-aware so a rehearsal run doesn't claim
to have cut a branch it skipped.

Prod-vs-non-prod side effects (Slack channel selection, customer-
facing publish jobs) are gated on the IS_PRODUCTION_REPO repository
variable. WIF provider/SA/GCP project selection is gated on a separate
USE_PROD_GCP variable so a staging-prod repo can exercise the prod
control-flow paths against the dev GCP project — operators set both
on the real prod repo, only IS_PRODUCTION_REPO on a rehearsal fork.
Forks default to dry-run automatically and cross-repo abuse is still
blocked at the WIF attribute_condition.

Per-job dispatch refs are restricted to master, release--rc, and
staging-v via if: allow-lists, with the release-ops environment's
deployment-branches policy as the authoritative gate behind the
single approve-publish job.

Release-26.1 adaptations not in the upstream PR:

• build-linux and build-per-platform-ibm in release-build-and-sign.yml
  gain docker/setup-buildx-action and docker/setup-qemu-action steps
  because the per-platform build script still does an in-job arm64
  docker build on this branch (master moved that to the separate
  build-docker job). Without QEMU binfmt handlers the arm64 RUN steps
  abort with 'exec format error'.
• build-cockroach-release-cloud-only.sh drops the pre-WIF unconditional
  gcr_staged_credentials assignments in the upper if/else block; the
  WIF-aware block below already handles them, and leaving the
  unconditionals in place trips set -u under WIF where
  GCS_CREDENTIALS_PROD/DEV are unset.

Release justification: release automation changes
Epic: none
Release note: None

[trunk-io]

😎 Merged successfully - details.

[blathers-crl]

Thanks for opening a backport.

Before merging, please confirm that the change does not break backwards compatibility and otherwise complies with the backport policy. Include a brief release justification in the PR description explaining why the backport is appropriate. All backports must be reviewed by the TL for the owning area. While the stricter LTS policy does not yet apply, please exercise judgment and consider gating non-critical changes behind a disabled-by-default feature flag when appropriate.

[blathers-crl]

Your pull request contains more than 1000 changes. It is strongly encouraged to split big PRs into smaller chunks.

_{🦉 Hoot! I am a Blathers, a bot for CockroachDB. My owner is dev-inf.}

[cockroach-teamcity]

This change is 

[blathers-crl]

Detected infrastructure failure on trunk-merge branch (matched: self-hosted runner lost communication with the server). Automatically resubmitting to merge queue (attempt 1 of 2). (run link)

[blathers-crl]

/trunk merge

[blathers-crl]

Detected infrastructure failure on trunk-merge branch (matched: self-hosted runner lost communication with the server). Automatically resubmitting to merge queue (attempt 2 of 2). (run link)

[blathers-crl]

/trunk merge