ci(release): fix the archive tsx path and patch the go-tools x/text HIGH (#665)

Two latent bugs the v2.2.0 release run surfaced, both added by #649 and never run
in a real release (v2.1.0 had no archive-security job).

archive-security asserted tsx at the workspace root, but tsx is a prod dependency
of apps/api, so pnpm places its bin at apps/api/node_modules/.bin/tsx, where the
Docker CMD runs it. The root path never existed and failed the extract step on
both arches. Fixed to the apps/api path, proven against the real prebuilt-amd64
artifact.

The blocking Trivy scans would then have failed on CVE-2026-56852,
golang.org/x/text v0.38.0 -> v0.39.0, the only fixed CRITICAL/HIGH in the image,
compiled into caire and pdfcpu. Pinned to v0.39.0 in both go-tools modules,
verified building in the golang:1.25.12 toolchain with -mod=readonly and linking
v0.39.0, with a clean Trivy rescan.

Guards added for both the tsx path and the x/text pin. Non-releasable type so a
re-dispatch re-runs 2.2.0.

tests/unit/security/dockerfile-build-args.test.ts

@@ -83,8 +83,12 @@ describe("Dockerfile build args", () => {
 
       expect(module).toContain(contract.application);
       expect(module).toContain("golang.org/x/image v0.43.0");
+      // x/text is pinned to the patched line the same way x/image is: 0.38.0
+      // carried CVE-2026-56852 (fixed in 0.39.0) and is linked into both binaries.
+      expect(module).toContain("golang.org/x/text v0.39.0");
       expect(checksums).toContain(`${contract.application} h1:`);
       expect(checksums).toContain("golang.org/x/image v0.43.0 h1:");
+      expect(checksums).toContain("golang.org/x/text v0.39.0 h1:");
       expect(stage).toContain(
         `COPY docker/go-tools/${contract.directory}/go.mod docker/go-tools/${contract.directory}/go.sum ./`,
       );