ci(release): fix the archive tsx path and patch the go-tools x/text HIGH (#665)

Two latent bugs the v2.2.0 release run surfaced, both added by #649 and never run
in a real release (v2.1.0 had no archive-security job).

archive-security asserted tsx at the workspace root, but tsx is a prod dependency
of apps/api, so pnpm places its bin at apps/api/node_modules/.bin/tsx, where the
Docker CMD runs it. The root path never existed and failed the extract step on
both arches. Fixed to the apps/api path, proven against the real prebuilt-amd64
artifact.

The blocking Trivy scans would then have failed on CVE-2026-56852,
golang.org/x/text v0.38.0 -> v0.39.0, the only fixed CRITICAL/HIGH in the image,
compiled into caire and pdfcpu. Pinned to v0.39.0 in both go-tools modules,
verified building in the golang:1.25.12 toolchain with -mod=readonly and linking
v0.39.0, with a clean Trivy rescan.

Guards added for both the tsx path and the x/text pin. Non-releasable type so a
re-dispatch re-runs 2.2.0.

.github/workflows/release.yml

@@ -367,8 +367,13 @@ jobs:
           PY
           test -s /tmp/prebuilt-root/snapotter/apps/web/dist/index.html
           test -s /tmp/prebuilt-root/snapotter/apps/api/src/index.ts
-          test -x /tmp/prebuilt-root/snapotter/node_modules/.bin/tsx
-          /tmp/prebuilt-root/snapotter/node_modules/.bin/tsx --version
+          # tsx is a prod dependency of apps/api, so pnpm's workspace layout puts
+          # its bin under apps/api/node_modules/.bin, not the workspace root. This
+          # is exactly where the Docker CMD runs it from (WORKDIR apps/api,
+          # ./node_modules/.bin/tsx). The root path never existed; this assertion
+          # was added in #649 and this is its first real release run.
+          test -x /tmp/prebuilt-root/snapotter/apps/api/node_modules/.bin/tsx
+          ( cd /tmp/prebuilt-root/snapotter/apps/api && ./node_modules/.bin/tsx --version )
           echo "archive_name=${archive_name}" >> "$GITHUB_ENV"
 
       - name: Install pinned Syft 1.42.3 from verified release bytes