fix(cli): inject Sentry DSN and PostHog credentials into Go binary

[Coly010]

What changed

• apps/cli/scripts/build.ts — buildGoTarget now reads SENTRY_DSN, POSTHOG_API_KEY, and POSTHOG_ENDPOINT from process.env and appends a matching -X github.com/supabase/cli/internal/utils.{SentryDsn,PostHogAPIKey,PostHogEndpoint}=... segment to the Go linker flags when the value is set.
• .github/workflows/release-shared.yml — the build job's env: block now exposes the three repo secrets so release builds get the values populated.

Why

Companion fix to #5313. The legacy CLI shell forwards telemetry through the bundled supabase-go binary, which reads its Sentry DSN and PostHog credentials from -ldflags -X-injected vars. The bun build script only injected utils.Version, so every release after the goreleaser → bun-script migration shipped with empty credentials:

• apps/cli-go/internal/telemetry/service.go:61 constructs the PostHog client with an empty key and host → the client returns a no-op (internal/telemetry/client.go:32-56).
• apps/cli-go/cmd/root.go:78 initializes Sentry with an empty DSN → no-op client.

PostHog event flow stopped on 2026-05-18 with v2.98.2 (the last build produced by the prior pipeline). Restoring these injections matches the historical .goreleaser.yml behavior using the same three repo secrets, which already exist (gh secret list --repo supabase/cli).

Reviewer notes

• The TS shells don't need build-time injection. The next shell carries hardcoded PostHog defaults with runtime env overrides (apps/cli/src/next/config/cli-config.layer.ts), and legacy delegates everything to the Go binary via LegacyGoProxy.
• The env vars are conditionally appended in the build script, so local builds and PR smoke builds (which don't expose the secrets) produce binaries with empty telemetry credentials and the existing safe no-op runtime behavior — no leakage and no test breakage.
• Verified locally: SENTRY_DSN=… POSTHOG_API_KEY=… POSTHOG_ENDPOINT=… pnpm exec bun apps/cli/scripts/build.ts --version 2.100.1 --shell legacy produces a supabase-go whose strings output contains the three sentinel values; running the same command with the envs unset produces a binary with none of them.

Fixes CLI-1506