chore: Ensure Set version uses private build mode

[danskmt]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages are release-note ready, emphasizing what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___)
• Includes product update to be announced in the next stable release notes

What does this PR do?

Ensures the prepare-build job's Set version step always uses private build mode for version generation. Flaky auto-detection of private module access in CI could produce public versions with the .oss suffix, inconsistent with the private builds used elsewhere in test_and_release.

Where should the reviewer start?

• .circleci/config.yml — prepare-build job, Set version step

How should this be manually tested?

1. Confirm the prepare-build job passes in CircleCI.
2. In the Set version step logs, confirm Build mode: private and that the generated version does not include an .oss suffix.

What's the product update that needs to be communicated to CLI users?

None. Internal CI change only.

Risk assessment (Low | Medium | High)?

Low

Any background context you want to provide?

Similar to #52987e419, which enforced private build mode on build-artifact jobs. Auto-detection via go mod download against cliv2-private can intermittently fail in CI, causing next-version.sh to run in public mode and append .oss to dev versions.

What are the relevant tickets?

CLI-1686

Screenshots (if appropriate)

N/A

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Inconsistent Build Mode Override 🟠 [major] The command 'make release-validate-version' on line 1527 is not updated to include 'BUILD_MODE=private'. While the surrounding make commands on lines 1526 and 1528 correctly force private mode, this intermediate validation step still relies on the auto-detection logic that the PR description characterizes as flaky. If this detection incorrectly identifies the build as 'public', the validation will fail because it will look for an '.oss' suffix that was explicitly omitted by the preceding forced-private generation step on line 1526. To ensure the fix is robust, the flag should be passed to all make invocations in this block or set as an environment variable for the entire step. make binary-releases/version binary-releases/fips/version BUILD_MODE=private make release-validate-version make ts-cli-binaries/version BINARY_RELEASES_FOLDER_TS_CLI=ts-cli-binaries BUILD_MODE=private

📚 Repository Context Analyzed This review considered 4 relevant code sections from 2 files (average relevance: 0.75) release-scripts/next-version.sh (lines 1-72) CONTRIBUTING.md (3 segments, lines 407-550)

🤖 Repository instructions applied (from AGENTS.md)