Verify the FIPS module in released binaries

[ilyakuz-db]

Changes

Adds a Verify FIPS module in binaries step to the release build. It reads each binary's build info and fails the release if any is missing the validated cryptographic module or does not default to FIPS mode.

Runs after signing, so it checks the artifacts that actually get published.

Merge after #6262, which is what sets GOFIPS140 in .goreleaser.yaml.

Why

#6262 makes releases FIPS builds, but nothing checks that the variable reached the artifacts. If it were dropped, the release would silently ship non-FIPS binaries, and the test suite could not catch it because tests build their own binary rather than inspecting dist/.

go version -m reads build info rather than the symbol table, so it works on stripped binaries and on the darwin/windows builds from the linux release runner.

Tests

Ran the script against real linux, windows and darwin binaries built with GOFIPS140=v1.0.0 -s -w -trimpath — all verified from a linux host. Swapping in a non-FIPS build fails with the offending path named, and the empty-dist/ guard fires so the loop cannot pass vacuously.

This PR was written by Claude Code.

[github-actions]

Waiting for approval

Based on git history, these people are best suited to review:

• @pietern -- recent work in .github/workflows/

Eligible reviewers: @andrewnester, @anton-107, @denik, @janniklasrose, @lennartkats-db, @rclarey, @renaudhartert-db, @rugpanov, @shreyas-goenka, @simonfaltum

_{Suggestions based on git history. See OWNERS for ownership rules.}