chore(ci): bump catalog to v2.2.0 + exercise binary builds on main

Catalog @v2.1.1 -> @v2.2.0 across 7 refs. Bundles a coverage fix: both binary builds (build, build-fips) now run on MR + default branch, not only tag pipelines. Closes the audit gap that left the --features fips compile path unverified until release time.