Parameterize shared Go release entrypoints

[c1-squire-dev]

Scope

Add the release options and preflight controls needed to bring cone and c1i onto the shared trusted release path.

Change

• Normalize and validate go_main_package from the pinned github-workflows checkout, then use it in every GoReleaser target.
• Add brew_tap with a fixed ConductorOne owner and a validated repository-name-only value.
• Add opt-in source hygiene, multi-platform govulncheck, and post-build module-version checks.
• Keep existing defaults unchanged for every caller.

Security

Inputs are never interpolated into shell commands. The normalizer rejects absolute, traversal, empty-component, and YAML-significant Go package paths, plus Homebrew tap path separators. Preflight checks run against the exact tag target before build; module-version verification runs before provenance or artifact upload.

Verification

• make test workflow-validate
• make verify is blocked locally because buf is not installed.