fix(release): replace goreleaser pro-only prebuilt builder with OSS-compatible shape

[trilamsr]

Summary

The v0.2.0 release pipeline failed at the Run goreleaser step with:

yaml: unmarshal errors:
  line 63: field prebuilt not found in type config.Build

Root cause: .goreleaser.yaml used builder: prebuilt to consume OCB's per-platform output, but prebuilt is a GoReleaser Pro-only feature ("This feature is exclusively available with GoReleaser Pro"). The OSS goreleaser-action installed by the workflow (distribution: goreleaser, version: ~> v2 → v2.16) cannot parse the field, so the YAML unmarshal fails before any build runs. RFC-0013 PR-A2 assumed OSS support; it does not have it.

Chosen fix (Approach C — drop goreleaser entirely):

• Delete .goreleaser.yaml.
• Rename the goreleaser job to package and inline the build → archive → checksum logic in shell. make build per-arch (linux/{amd64,arm64}) writes ./_build/tracecore; we stage it alongside LICENSE + README.md, tar with --sort=name --owner=0 --group=0 --numeric-owner --mtime=@$SOURCE_DATE_EPOCH | gzip -n, then append a sha256sum line to dist/checksums.txt.
• Generate per-archive CycloneDX SBOMs by calling syft <archive> -o cyclonedx-json=<archive>.sbom.cdx.json directly (same engine the goreleaser sboms: stanza shelled out to).
• Create the GitHub Release via gh release create "$TAG" --title "$TAG" --generate-notes [--prerelease] dist/*.tar.gz dist/*.sbom.cdx.json dist/checksums.txt.

Tradeoffs:

• We lose goreleaser's grouped changelog (Features / Bug fixes / Performance / Other regexes). --generate-notes gives a flat commit list — good enough for routine releases, and operators can hand-edit via gh release edit "$TAG" --notes-file … for marquee releases.
• We give up mod_timestamp: "{{ .CommitTimestamp }}" templating, but the same SOURCE_DATE_EPOCH is now passed to tar --mtime directly so byte-reproducibility against the tag commit is preserved.
• Fewer moving parts: no goreleaser binary install, no goreleaser-action SHA pin to maintain, no ~> v2 floating-version risk, no Pro-vs-OSS field-compatibility footgun.

The downstream sbom, sign, provenance, attest, and ko-publish jobs are unchanged aside from the needs: job-name rename (goreleaser → package) and the matching needs.<job>.outputs.{tag,hashes} references. SBOM / cosign-keyless / SLSA v1.0 / attest-build-provenance chain is preserved end-to-end.

Considered and rejected:

• Option A (foreign-binary via archives.files): still requires goreleaser to know about each binary's existence; without prebuilt, there's no OSS-compatible way to tell goreleaser "package this file as an archive without compiling anything".
• Option B (no-op Go shim + hooks.pre make build): fragile, ugly, leaves a fake main.go in the tree just to satisfy goreleaser's default builder.

Test plan

Ran locally:

• actionlint .github/workflows/release.yml — clean.
• make check — green (gofumpt, tidy-check, golangci-lint, go vet, go mod verify).
• Grep swept for stale goreleaser/needs.goreleaser references — only intentional historical comments remain.

Will be exercised on the v0.2.1 tag push after merge:

• package job builds linux/{amd64,arm64} OCB binaries, archives + checksums, creates the GitHub Release with --generate-notes.
• sbom (source-tree CycloneDX) uploads to the release.
• sign (cosign-keyless) signs + verifies tar.gz + checksums.txt; uploads bundles.
• provenance (SLSA v1.0 reusable workflow) attaches provenance to the release with upload-tag-name: $TAG.
• attest (GitHub actions/attest-build-provenance) attests each tar.gz.
• ko-publish builds + pushes ghcr.io/tracecoreai/tracecore:0.2.1 + :latest, cosign-signs by digest, attests image.

Reproducible-archive sanity (post-merge, on the runner): two consecutive make build + tar invocations against the same SOURCE_DATE_EPOCH should produce byte-identical .tar.gz files (operator can spot-check via sha256sum in the workflow logs).

Followups

• Operator must cut v0.2.1 after this merges. That is the first installable release. Suggested:

  git tag -s v0.2.1 -m 'v0.2.1: first installable release (goreleaser-pro fix)'
  git push origin v0.2.1

• v0.2.0 tag handling: deletion is blocked by branch-protection rules, so the tag stays on origin as a "failed release" marker. No GitHub Release object was ever created against it, so gh release view v0.2.0 will continue to 404 — operators landing on the tag should be steered to v0.2.1. (Alternative: a maintainer with admin override can delete v0.2.0 if the marker is undesirable; not blocking.)
• Re-running the failed v0.2.0 workflow is intentionally NOT a fix path — even with this PR merged, the v0.2.0 tag points at commit 0025969 which still carries the old .goreleaser.yaml. The fix only takes effect for tags pushed after this PR merges to main.
• Doc rot: docs/notes/reproducibility.md and docs/reproducibility.md reference .github/workflows/goreleaser.yml (a path that has never existed in this repo — workflow is release.yml) and describe goreleaser as the build engine. Out of scope here; tracked separately.

fix(release): replace GoReleaser Pro-only `prebuilt` builder with an OSS-compatible shell-based packaging job. Drops `.goreleaser.yaml`; binary archive + checksum + per-archive SBOM are now produced by inline shell + syft, and the GitHub Release is created via `gh release create --generate-notes`. SBOM / cosign-keyless / SLSA v1.0 / GitHub attest-build-provenance chain is preserved end-to-end.

---

Reviewer A+ deltas applied (commit 47e4f32)

Per fresh-context review:

• HIGH — fixed tar archive wrap-in-directory regression. Previous tar -C dist/stage -cf - "tracecore_${ver}_linux_${arch}" wrapped contents in a versioned subdir. goreleaser v2's wrap_in_directory defaults to false, and the deleted .goreleaser.yaml never set it, so the prior release shape emitted ./tracecore at archive root. Now: tar from inside the staging dir with . so contents land at archive root. Preserves curl … | tar xz && ./tracecore operator muscle memory.
• MEDIUM — gh release create made idempotent. On workflow retries (transient gh API failure, SLSA-reusable manual rerun-all-jobs), the previous shape exited non-zero. Now: gh release view as guard + gh release upload --clobber for assets, mirroring the sign job's bundle pattern.
• LOW deltas declined (per [[no-bloat]] / scope discipline): SOURCE_DATE_EPOCH already wired via Makefile mod_timestamp; SLSA reusable v2.1→v2.2 bump deferred to separate PR; defense-in-depth nullglob count guard not load-bearing (upload-artifact if-no-files-found: error catches upstream).