ci: derive release Go version from go.mod

[David Gamero (davidgamero)]

Summary

• Derive the Go version from go.mod in every explicit Go setup used by build workflows.
• Add a read-only Release Build Preflight on pull requests that cross-compiles all five release targets with GOTOOLCHAIN=local.
• Add workflow_dispatch for release recovery. Publishing runs only on main and never on pull requests.

Root cause

The v0.17.16 post-merge release installed Go 1.25.14 while go.mod requires Go 1.26.0. With GOTOOLCHAIN=local, make build-all failed immediately. PR checks used Go 1.26 and never exercised the release-only setup.

Failed run: https://github.com/Azure/draft/actions/runs/38359203193

Prevention

• go.mod is the single source of truth for Go setup.
• PR preflight executes the same make build-all target and disables automatic toolchain switching so stale setup cannot be hidden.
• Preflight has contents: read only and contains no tagging or publishing steps.
• Manual dispatch on main can recover a failed release using the corrected workflow after merge.

Verification

• Reproduced the version mismatch locally with Go 1.25.7 and GOTOOLCHAIN=local.
• With Go 1.26.0 explicitly on PATH and GOTOOLCHAIN=local, DRAFT_VERSION=preflight make build-all passed for Windows amd64, Linux amd64/arm64, and Darwin amd64/arm64.
• All workflow YAML files parse successfully.
• git diff --check passed.

Release recovery

After merge, dispatch Draft Release & Publish on main to build and publish the changelog version. Rerunning the old failed run would use its old revision.