release-24.3: release tooling: bundled backport of GHA-migration follow-ups

[rail]

Backport of 8 release-26.1 PRs onto release-24.3 so the new GitHub
Actions release pipeline can drive 24.3 patch releases on behalf of @rail:

• release-26.1: migrate release pipelines from TeamCity to GitHub Actions #170348 release: migrate release pipelines from TeamCity to GitHub Actions
• release-26.1: build,release: forward IS_PRODUCTION_REPO into the release binary #170392 build,release: forward IS_PRODUCTION_REPO into the release binary
• release-26.1: build: use gha-releases service account for prod release uploads #170657 release: fix two prod release-workflow bugs
• release-26.1: release: bump release-notes API client timeout to 2 minutes #170670 release: bump release-notes API client timeout to 2 minutes
• release-26.1: release: fix two more prod release-workflow auth bugs #170686 release: fix two more prod release-workflow auth bugs
• release-26.1: release/sentry: use 'gcloud storage cp' to download artifact #170727 release/sentry: use 'gcloud storage cp' to download artifact
• release-26.1: release: follow-ups to the pick-sha + cloud-rollout flow #170765 release: follow-ups to the pick-sha + cloud-rollout flow
• release-26.1: release: route build/publish notify to #release-ops by ID-vs-name #170779 release: route build/publish notify to #release-ops by ID-vs-name

Same wholesale-replacement strategy as the release-25.2 backport
(#170813). release-24.3 still carries the legacy email/Jira release
tooling, so the migration PR's pick_sha.go collides with the
pre-existing one. Rather than hand-merging hundreds of hunks,
pkg/cmd/release/ is replaced with the post-PR state from
release-26.1 (tip 97b3f3e), and the four GHA workflows plus
build/github/release-*.sh wrappers are added. Shared TeamCity-era
scripts (build/release/teamcity-*.sh, build/teamcity-bazel- support.sh, the TC build-cockroach-release-*.sh scripts that the
new pipeline calls into) are lifted from release-26.1 too — the
migration's edits there are additive WIF-auth branches gated on
CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE, so the legacy TeamCity
code paths still work.

Dep changes:

• cockroachdb/version added as a new dep at the May 2025 pin —
  release-24.3 didn't carry it at all. go-github/v61 also added.
• Orphaned deps from the deleted legacy tooling dropped:
  andygrunwald/go-jira, google/go-github/v42, indirect
  trivago/tgo and fatih/structs.
• DEPS.bzl regenerated. Note: pkg/build/info.go is unchanged on
  this branch because release-24.3 uses the internal
  pkg/util/version package and never adopted the
  cockroachdb/version external module (so the
  IsCustomOrNightlyBuild → IsCustomOrAdhocBuild rename that
  release-25.2's backport had to handle doesn't apply here).

Branch-specific adjustments (vs. the version copied from 26.1):

• verify_docker_image reverted to detect FIPS via Go version +
  OpenSSL fingerprint. The 26.1 version greps for a FIPS enabled: true line that requires the crypto/fips140-based check in
  pkg/build/info.go introduced post-24.3.
• TEAMCITY_BUILD_PROPERTIES_FILE mount removed from run_bazel —
  the var isn't set in release-24.3's TC environment.
• run_bazel_fips left removed (no callers on release-24.3).
• linux-s390x dropped from build-linux / build-per-platform-ibm
  matrices, release-sign-ibm.sh's iteration, the publish-staged
  platforms list, and the cloud-only comment. release-24.3 does not
  build s390x. IBM build/sign jobs are kept (no-telemetry linux
  variants, not s390x-only).
• build-cockroach-release-per-platform.sh reverted to
  publish-provisional-artifacts -provisional -release — release-24.3
  predates the publish-artifacts rename + release subcommand split.
• build-cockroach-release-per-platform.sh restores the
  --build-arg fips_enabled=1 branch for the FIPS docker image; the
  release-24.3 build/deploy/Dockerfile gates FIPS package
  installation on this arg.
• make-and-publish-* TC-only nightly scripts reverted to 24.3
  originals — they aren't on the GHA call path.

Release justification: release-tooling backport for GHA migration.

Epic: none
Release note: None

[trunk-io]

Merging to release-24.3 in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[blathers-crl]

Thanks for opening a backport.

Before merging, please confirm that it falls into one of the following categories (select one):

• Non-production code changes OR fixes for serious issues. Non-production includes test-only changes, build system changes, etc. Serious issues are defined in the policy as correctness, stability, or security issues, data corruption/loss, significant performance regressions, breaking working and widely used functionality, or an inability to detect and debug production issues.
• Other approved changes. These changes must be gated behind a disabled-by-default feature flag unless there is a strong justification not to. Reference the approved ENGREQ ticket in the PR body (e.g., "Fixes ENGREQ-123").

Add a brief release justification to the PR description explaining your selection.

Also, confirm that the change does not break backward compatibility and complies with all aspects of the backport policy.

All backports must be reviewed by the TL and EM for the owning area.

[blathers-crl]

Your pull request contains more than 1000 changes. It is strongly encouraged to split big PRs into smaller chunks.

_{🦉 Hoot! I am a Blathers, a bot for CockroachDB. My owner is dev-inf.}

[cockroach-teamcity]

This change is