S5: release through a reusable builder; daily OSV scan

[aledbf]

S5 for spin-machine.

• Reusable builder. release.yml (dispatch on main) publishes nothing: it calls build-release.yml (on: workflow_call alone), which holds the old release job: build, fingerprint-diff/notes, provenance, sign/attest/verify, tag, publish. The certificate names the builder, so the identity is now https://github.com/spin-stack/spin-machine/.github/workflows/build-release.yml@refs/heads/main. go tool provenance -builder makes builder.id say the same; externalParameters.workflow stays release.yml. workflows_test sets attestgate's Builder (planted: pointing it at release.yml fails on both rules).
• Isolation. The builder runs on ubuntu-24.04 with an empty docker-container BuildKit, reading no cache (no Blacksmith sticky disk, no type=gha scopes). Blacksmith's certificate reads self-hosted, and main's lane cache is an input no pin holds. This was a fork the plan left open ("cache dropped or named as resolvedDependencies"). I chose to drop the cache: each release compiles QEMU, the kernel and the image from cold (timeout 300 min). The builds are reproducible, so the bytes do not change; hack/fingerprint-diff reports it if they ever do. A "Make room on the disk" step frees the runner's unused toolchains.
• osv.yml (daily + dispatch): task osv downloads the newest release's .cdx.json, checks its signature against the builder identity, runs osv-scanner (new versions.yaml entry, v2.7.0, via go run like actionlint), and writes _output/osv.tsv. The workflow opens one issue per finding, matched by exact title across open and closed issues, so a closed finding is never reopened. Checked: osv-scanner v2.7.0 reads go-tools' nested CycloneDX (171 packages from spin-term's) and the jq extraction.
• go-tools a38a073.

Flag day: spin's release.Machine identity has to move to build-release.yml before spin takes the first machine release cut through this; that change follows in spin. No machine release from main exists yet, so nothing verifies in between.

task lint, task test green; task mutate: no Go outside tests.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}