ci: migrate SBOM, ReARM, and release workflows

[VinnyBarton]

Summary

• replace the duplicated source-SBOM generation, SecureSBOM signing and verification, OSV scanning, and Interlynk upload jobs with shared workflows
• replace the duplicated ReARM integration with the shared ReARM evidence workflow
• replace the duplicated GoReleaser and moving-major-tag logic with the shared Go release workflow
• attach the verified signed SBOM to tagged GitHub releases and generate build provenance
• reduce the three workflows by 461 net lines

Dependency

• depends on feat: attach signed evidence to Go releases supply-chain-workflows#11
• all reusable calls are pinned to that PR's full commit SHA
• merge the shared-workflow PR first; after merge, the immutable commit pin remains valid

Security changes

• replaces the mutable osv-scanner container tag with a digest-pinned scanner
• scanner failures and detected vulnerabilities now fail closed
• replaces the unchecked PyLynk clone with a reviewed tag-to-commit verification
• removes workflow output and ref debug logging
• uses named secrets only; no secrets inheritance
• validates paths, artifact names, endpoints, versions, and release tags at reusable-workflow boundaries
• release publication waits for signed-SBOM generation, verification, and vulnerability scanning

Verification

• Actionlint v1.7.7 and ShellCheck passed for all three migrated callers
• git diff --check passed
• the referenced shared-workflow commit passed Actionlint, workflow policy, and Zizmor in supply-chain-workflows#11

No human-review requirement is added by this change. Configured CI checks must pass before merge.