[deckhouse-cli] Revert "Bump stronghold to v1.18.6" and guard CI

[Glitchy-Sheep]

Summary

Releases are blocked: after #415 the trdl server cannot build d8. This PR reverts #415 and adds a CI check that runs the same build on risky PRs, so a broken release pipeline shows up in the PR, not on a tag.

Problem

#415 switched the build image in trdl.yaml to builder/golang-alt. The trdl server cannot use it:

• the server needs root: its generated Dockerfile runs mkdir -p /result in the filesystem root, and the image runs as user 64535:64535
• the image is ALT-based, and the commands in trdl.yaml are written for Debian (apt-get package names, dpkg -L)

The v0.33.5 release failed on mkdir -p /result: Permission denied and retried for 6 hours: https://github.com/deckhouse/deckhouse-cli/actions/runs/30816427104

GitHub CI stayed green: it never runs this image, it only unpacks /usr/local/go from it.

v0.33.5 ended up as a GitHub release that cannot reach the trdl channels.

Fix

Revert #415:

• trdl.yaml builds on the root Debian image again
• release builds use stock Go, without the gost build tag
• stronghold goes back to the previous version (sdk/api v1.16.18)
• the d8 stronghold operator raft snapshot inspect command goes away with it

Conflict note: golang.org/x/sync stays a direct dependency (added later by #431).

The stronghold v1.18.6 + GOST work should come back with a trdl-compatible builder image: root user, build deps preinstalled or installed with ALT package names.

Protection: trdl build check in CI

The failure stayed hidden until a tag because nothing runs the trdl build before it. The new check closes this gap.

What it does:

• .github/scripts/trdl-build-check.sh generates the same Dockerfile the trdl server generates from trdl.yaml
• runs docker build with the same secret ids on a fake tag
• fails unless release artifacts land in /result

Secrets it uses (both already exist in CI, nothing new to add):

• SOURCE_REPO_SSH_KEY - SSH key to read the private repos, passed to the build as the stronghold-ssh secret
• DECKHOUSE_PRIVATE_REPO - private repo hostname, passed as the deckhouse-private-repo secret

When it runs:

• on PRs that touch trdl.yaml, go.mod, go.sum or Taskfile.yml
• weekly by cron and manually via workflow_dispatch
• PRs from forks are skipped: they get no secrets

Green check means the next tag will build on the trdl server. A change like #415 now fails in its own PR, in the first minute.

Tests

• the reverted tree builds with stock Go (CGO_ENABLED=0, release tag set without gost)
• the new check ran on this PR and passed: full trdl release build end to end in 4 minutes