[backport-aws-7.1] Sync CI configuration with main branch - #21150

This PR backports CI and automation updates from main onto the backport-aws-7.1 branch so that branch-scoped Buildkite and GitHub Actions workflows continue to run correctly on active backport branches.

Changes:

• Sync Buildkite pipelines/scripts and GitHub Actions workflows with main (including updated permission checks and path watches).
• Update the backport CLI module dependencies and adjust backport-tool tests/docs references to the new cmd/backport/** layout.
• Improve package detection in Buildkite scripts by cross-referencing mage listPackages output (handles nested package roots).

Suppressed comments (2)

.buildkite/scripts/backport_branch.sh:168

• grep -E doesn’t treat \s as whitespace, so these lookups won’t match the indented K8S_VERSION: / KIND_VERSION: lines in .buildkite/pipeline.serverless.yml, and the values won’t be preserved.

  if [ -f "${pipeline_serverless_yml}" ]; then
    serverless_k8s_version_line=$(grep -E '^\s*K8S_VERSION:' "${pipeline_serverless_yml}" || true)
    serverless_kind_version_line=$(grep -E '^\s*KIND_VERSION:' "${pipeline_serverless_yml}" || true)
    echo "Preserving from backport branch (pipeline.serverless.yml): ${serverless_k8s_version_line}, ${serverless_kind_version_line}"
  fi

.buildkite/scripts/backport_branch.sh:184

• The sed search regex uses \s, which isn’t a portable whitespace matcher and won’t match the indented K8S_VERSION: / KIND_VERSION: lines in the current pipeline YAMLs. That can prevent restoring the version pins after syncing the .buildkite directory.

    echo "--- Restoring KIND_VERSION in ${pipeline_yml}..."
    sed -i "s|^\s*KIND_VERSION:.*|${kind_version_line}|" "${pipeline_yml}"
  fi
  if [ -n "${serverless_k8s_version_line}" ]; then
    echo "--- Restoring K8S_VERSION in ${pipeline_serverless_yml}..."

• Files reviewed: 14/15 changed files
• Comments generated: 1
• Review effort level: Lite