release-25.2: release tooling: bundled backport of GHA-migration follow-ups

[rail]

Backport of 8 release-26.1 PRs onto release-25.2 so the new GitHub
Actions release pipeline can drive 25.2 patch releases on behalf of @rail:

• release-26.1: migrate release pipelines from TeamCity to GitHub Actions #170348 release: migrate release pipelines from TeamCity to GitHub Actions
• release-26.1: build,release: forward IS_PRODUCTION_REPO into the release binary #170392 build,release: forward IS_PRODUCTION_REPO into the release binary
• release-26.1: build: use gha-releases service account for prod release uploads #170657 release: fix two prod release-workflow bugs
• release-26.1: release: bump release-notes API client timeout to 2 minutes #170670 release: bump release-notes API client timeout to 2 minutes
• release-26.1: release: fix two more prod release-workflow auth bugs #170686 release: fix two more prod release-workflow auth bugs
• release-26.1: release/sentry: use 'gcloud storage cp' to download artifact #170727 release/sentry: use 'gcloud storage cp' to download artifact
• release-26.1: release: follow-ups to the pick-sha + cloud-rollout flow #170765 release: follow-ups to the pick-sha + cloud-rollout flow
• release-26.1: release: route build/publish notify to #release-ops by ID-vs-name #170779 release: route build/publish notify to #release-ops by ID-vs-name

Unlike the release-25.4 backport (#170804), the 8 commits do not
cherry-pick cleanly onto release-25.2 — the legacy email/Jira release
tooling (blockers.go, github.go, jira.go, metadata.go, orchestration.go,
set_cockroach_version.go, their tests and templates) was removed before
release-25.4 was cut, so the migration PR introduces a pick_sha.go
that collides with release-25.2's pre-existing one. Rather than
hand-merging hundreds of hunks, the release-tooling code is replaced
wholesale with the post-PR state from release-26.1 (tip 97b3f3e):

• pkg/cmd/release/ library + sentry tool lifted from release-26.1;
  the legacy email-tooling Go files, templates, and testdata deleted
  to match release-25.4's already-pruned shape.
• .github/workflows/release-{branch-cut,build-and-sign,pick-sha, publish}.yml added.
• build/github/release-*.sh wrapper scripts added.
• Shared TeamCity-era scripts (build/release/teamcity-*.sh,
  build/teamcity-bazel-support.sh, build/teamcity-common-support.sh,
  build/teamcity/internal/cockroach/release/{process,publish}/*.sh,
  build/teamcity/internal/release/process/build-cockroach-release-*.sh)
  lifted from release-26.1; the migration's edits here are additive
  WIF-auth branches gated on CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE,
  so the legacy TeamCity code paths still work.
• cockroachdb/version bumped from the March 2025 pin to the May 2025
  pin so the new pkg/cmd/release can use version.IncPreRelease /
  IncPatch. The bump renames IsCustomOrNightlyBuild to
  IsCustomOrAdhocBuild on the *Version receiver; the one caller in
  pkg/build/info.go is updated.

Branch-specific adjustments (release-25.2 differs from release-26.1 in
ways the 26.1 versions of these scripts didn't anticipate):

• verify_docker_image reverted to detect FIPS via Go version + OpenSSL
  fingerprint. The 26.1 version grep's for a FIPS enabled: true line
  that requires the crypto/fips140-based check in pkg/build/info.go
  introduced post-25.2; release-25.2's cockroach binary does not emit it.
• TEAMCITY_BUILD_PROPERTIES_FILE mount removed from run_bazel — the
  migration added it on master for a reason that doesn't apply on 25.2,
  where the var isn't set in the TC environment.
• run_bazel_fips left removed (no callers on release-25.2).
• linux-s390x dropped from build-linux / build-per-platform-ibm
  matrices, release-sign-ibm.sh's iteration, and the cloud-only
  comment. release-25.2 does not build s390x. IBM build/sign jobs are
  kept (they're the no-telemetry linux variants, not s390x-only).
• build-cockroach-release-per-platform.sh reverted to
  publish-provisional-artifacts -provisional -release — release-25.2
  predates the publish-artifacts rename + release subcommand split.
• build-cockroach-release-per-platform.sh restores the
  --build-arg fips_enabled=1 branch for the FIPS docker image; the
  release-25.2 build/deploy/Dockerfile gates FIPS package installation
  on this arg.
• make-and-publish-* TC-only nightly scripts reverted to 25.2
  originals — they aren't on the GHA call path.

Release justification: release-tooling backport for GHA migration.

Epic: none
Release note: None

[blathers-crl]

Thanks for opening a backport.

Before merging, please confirm that it falls into one of the following categories (select one):

• Non-production code changes OR fixes for serious issues. Non-production includes test-only changes, build system changes, etc. Serious issues are defined in the policy as correctness, stability, or security issues, data corruption/loss, significant performance regressions, breaking working and widely used functionality, or an inability to detect and debug production issues.
• Other approved changes. These changes must be gated behind a disabled-by-default feature flag unless there is a strong justification not to. Reference the approved ENGREQ ticket in the PR body (e.g., "Fixes ENGREQ-123").

Add a brief release justification to the PR description explaining your selection.

Also, confirm that the change does not break backward compatibility and complies with all aspects of the backport policy.

All backports must be reviewed by the TL and EM for the owning area.

[trunk-io]

Merging to release-25.2 in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[blathers-crl]

Your pull request contains more than 1000 changes. It is strongly encouraged to split big PRs into smaller chunks.

_{🦉 Hoot! I am a Blathers, a bot for CockroachDB. My owner is dev-inf.}

[cockroach-teamcity]

This change is