fix(ci): widen release-darwin poll budget + early-bail on release-go failure

[aksOps]

Summary

Both `release-go.yml` and `release-darwin.yml` fire on the same tag push. `release-go` runs goreleaser (CGO + Kuzu + Cosign + SBOM) — typically 4–8 minutes before the Release object appears. `release-darwin` tried 3 polls × 30s = 90s total and timed out every time:

```
Release v0.X.Y not yet visible, waiting 30s (1/3)...
Release v0.X.Y not yet visible, waiting 30s (2/3)...
Release v0.X.Y not yet visible, waiting 30s (3/3)...
::error::Release v0.X.Y never appeared; release-go.yml may have failed
```

Both v0.3.0 and v0.4.0 needed a manual `gh run rerun --failed` to recover after the upstream Release became visible.

Fix

1. Bump poll budget to 30 × 30s = 15 minutes. Covers release-go's worst case plus headroom for proxy publish lag.
2. Early-bail when the upstream tanks. On each poll iteration, check the `release-go.yml` workflow run status for this tag via `gh run list`. If it concluded as `failure` / `cancelled` / `timed_out`, exit immediately with an actionable error rather than riding the full 15-min timeout.
3. Pin `--repo "$REPO"` on every `gh` invocation. The macOS runner's inferred repo (from `gh auth status`) can drift; explicit pins make the workflow position-independent.

No change to release-go.yml — it was working as designed; the race was entirely on the darwin side's tight polling window.

Test plan

• YAML parses (`python3 -c "import yaml; yaml.safe_load(...)"`)
• Pattern hand-traced against the v0.4.0 failure: under the old code, the third poll fired ~90s after job start while release-go was still inside the goreleaser `build` step at 5+ minutes. The new code's 30th poll fires at 15 minutes — well past goreleaser's typical wall.
• Functional confirmation lands on the next tag push.

Out of scope

• Switching to a `workflow_run` trigger instead of `push: tags:` would be cleaner long-term (no race possible) but requires reworking how the darwin job retrieves the source SHA — saving for a follow-up.
• `draft: true` in `.goreleaser.yml` means every release still requires a manual `gh release edit --draft=false` to publish. Defensible default for a security-sensitive release — left in place.

🤖 Generated with Claude Code