fix(release): pass FreeBSD build flags safely

[ssfun]

Summary

• pass reproducibility flags through Go's supported GOFLAGS environment variable
• keep the go-cross action flags input limited to the single linker flag it can pass safely
• preserve existing version, commit and build-date injection through x-flags

Root cause

go-cross/cgo-actions interpolates its entire flags input as one process argument. The combined -buildvcs=false -trimpath -ldflags=-s -w string therefore became the value of -buildvcs, and Go 1.26 rejected it. This independently blocked the FreeBSD plugin matrix in release runs 29936326151 and 29937963776.

Validation

• actual Core server build passed with GOFLAGS=-buildvcs=false -trimpath and a single -ldflags=-s -w argument
• 19 Management customization/security tests passed
• 2 reproducible archive tests passed
• repository syntax, JSON, action pin and whitespace checks passed