feat: invert cli-stack build flow using pipeline wait mechanism

[sampras343]

Summary

• Invert the dependency between fetch-tsa-certs and fetch-tsa-certs-cli-stack so the cli-stack builds first and the component image extracts binaries from it
• Eliminates Konflux nudges between the two components by using the existing wait-for-pipelinerun task (same pattern as operator-bundle builds)
• Since CGO_ENABLED=0 across all Build.mak targets, the cli-stack cross-compiles all 7 binaries from a single amd64 builder

How it works

1. Same commit triggers both PipelineRuns (identical CEL path filters)
2. fetch-tsa-certs pipeline uses manager-pipelinerun-selector to wait for fetch-tsa-certs-cli-stack to complete
3. The cli-stack digest is injected as CLI_STACK_IMAGE build arg into the component Dockerfile
4. Each multi-platform builder extracts the correct binary using TARGETARCH

Changes

File	Change
Build.mak	Add Linux cross-compilation targets (amd64, arm64, ppc64le, s390x) and all-platforms meta-target
Dockerfile.cli-stack.rh	Build all 7 binaries from source in a single stage (no external image dependency)
Dockerfile.fetch_tsa_certs.rh	Extract binary from cli-stack image using TARGETARCH (no source compilation)
.tekton/*-cli-stack-*.yaml	Add CEL path filters for source changes
.tekton/fetch-tsa-certs-*.yaml	Add manager-pipelinerun-selector to wait for cli-stack; remove go_unit_test, prefetch-input

Risk

FROM --platform=linux/amd64 ${CLI_STACK_IMAGE} on non-amd64 builders — Buildah may reject cross-platform FROM. If so, fallback to auto-merge nudge pattern.

Related

• SECURESIGN-4992
• Reuses the wait-for-pipelinerun task from securesign/pipelines (same mechanism as operator-bundle builds)
• Companion change needed in pipelines repo: remove build-nudges-ref from fetch-tsa component config

Test plan

• Verify cli-stack PipelineRun builds all 7 binaries from source
• Verify component PipelineRun waits for cli-stack and receives the correct digest
• Verify multi-platform builders each extract the correct arch binary
• Verify no nudge PRs are created between cli-stack and component
• Test the FROM --platform=linux/amd64 pattern works on arm64/ppc64le/s390x builders