chore: script the release steps and conform to the reference v2 standards

What this does

A release used to move version pins in nine files by hand, and nothing checked that they agreed. Four scripts under scripts/ now do the moving and the checking, a version-consistency job runs the check on every pipeline, and CONTRIBUTING.md ## Releasing holds the three procedures a maintainer follows: an upstream kaniko release, a base-image rebuild, and a Go toolchain bump.

• set-release.sh vX.Y.Z[-N] rewrites every image-tag pin in the docs and examples, and the upstream pin when the upstream version changes.
• check-versions.sh proves the pins name one release and that CHANGELOG.md has its section. A Renovate upstream bump fails it until the release work is done, and the failure says which file pins what.
• tag-release.sh vX.Y.Z checks the tree, builds the annotated tag from the CHANGELOG section, and prints the push command.
• go-checksum.sh fetches the published amd64 and arm64 digests for GO_VERSION and rewrites all eight declarations. Run against the current version, it reproduced the digests already in the tree.

A base-image fix between upstream releases ships as vX.Y.Z-N. KANIKO_VERSION stays on the upstream version; only the git tag and the image tags carry the suffix.

Three claims that were not true of the tree are gone: UBI_VERSION, passed to all six builds and interpolated by nothing; the Changelog: commit trailer, described as input to a generator that was never wired up; and .reference.yaml declaring no exemptions while failing two standards. GOFIPS140_VERSION carries a comment naming it a compliance pin.

Reference conformance

Against reference v2.2.0, 19 standards pass, up from 16 on main. CONTRIBUTING.md carries the DCO, Government-Work and AI-disclosure paragraphs from the reference template, and agent-authored commits carry AI-Assisted: and AI-Tools: in place of Co-Authored-By:. renovate.json drops the preset-owned automerge and labels keys, and the osv-verdict component joins the test stage. The two remaining failures are the registered exemptions: license, because the Apache-2.0 text is inherited from the upstream fork and has no GitLab holder line, and the changelog assertion that CHANGELOG.md mention the Changelog: trailer.

Verification

hadolint, shellcheck and glab ci lint are clean. set-release.sh ran on scratch copies for an upstream bump and for a rebuild tag; CHANGELOG.md was byte-identical after both. tag-release.sh --dry-run extracted the v1.25.19 section. The v1.25.19 CHANGELOG section listed UBI 9.5 in its pinned versions against a release built on 9.8 and is corrected.

Not in this MR

Building arm64 (the checksum path stays for it), .gitlab/posture-claims.yaml, and a catalog verify input so all six variants are verified in CI.