[backport-cloud_security_posture-1.7] Sync CI configuration with main branch - #21259

This PR synchronizes CI configuration and backport tooling from main to backport-cloud_security_posture-1.7.

Changes:

• Adds Buildkite and GitHub Actions backport automation.
• Adds the standalone backport CLI and supporting scripts.
• Updates package validation, coverage tooling, dependencies, and fixtures.

The review identified unresolved critical and moderate issues in automation, synchronization, path handling, and helper scripts, along with documentation and help-command nits.

Suppressed comments (18)

.buildkite/pipeline.yml:168

• This makes the owner check non-blocking: check_backport_owners.sh exits 1 when it finds mismatches, but soft_fail: true lets the Buildkite build (and therefore the backport PR) pass anyway. Since this check is intended to enforce owner synchronization on PRs targeting backport branches, remove the soft-fail setting or set it to false.
  .buildkite/scripts/backport_branch.sh:172
• git rm --cached removes only the index entry and leaves backport-only tracked files in the worktree; the following git add .buildkite stages those stale files again. This means the branch is not synced verbatim from main and obsolete CI scripts can persist. Remove the tracked directory from both index and worktree before checking out main (and apply the same change to the other directory syncs below).
  .buildkite/scripts/backport_branch.sh:214
• As with the .buildkite sync above, --cached leaves tracked files that exist only on the backport branch in the worktree, and git add cmd/backport re-adds them. Obsolete files can therefore survive the supposed copy from main; remove the directory from the worktree as well before checking it out.
  .buildkite/scripts/backport_branch.sh:219
• --cached leaves tracked files absent from main in the worktree, and the later git add dev stages them again. The dev/ tree can consequently retain obsolete scripts despite this sync; remove the tracked directory from the worktree before checking out main.
  .buildkite/scripts/backport_branch.sh:245
• --cached leaves tracked workflows that were removed from main in the worktree, and git add .github/workflows stages them back into the branch. This can preserve obsolete workflows and violates the stated verbatim sync; remove the tracked directory from the worktree before checking out main.
  .buildkite/scripts/backport_branch.sh:250
• --cached leaves tracked actions absent from main in the worktree, and the subsequent git add .github/actions stages them again. Obsolete actions can therefore survive this sync; remove the tracked directory from the worktree before checking out main.
  .buildkite/scripts/test_integrations_with_serverless.sh:102
• This duplicates the same grep -q/pipefail hazard in the serverless matrix: a sufficiently large changed-file list can cause SIGPIPE and silently drop the matching package. Replace both quiet greps with non-quiet greps redirected to /dev/null, as done elsewhere in common.sh.
  .buildkite/scripts/trigger_integrations_in_parallel.sh:70
• These grep -q pipelines run with pipefail; when a large changed-file list exceeds the pipe buffer, grep can exit after the first match and echo can receive SIGPIPE, making the condition false. That can omit an affected package from the generated test matrix. Use the existing no--q pattern (grep -E ... > /dev/null) here.
  .github/workflows/auto-backport.yml:108
• The issue-comment path never verifies that the merged PR targets main (the push path does). A marker-containing comment on a merged PR targeting another branch can therefore enter the backport processor and use that PR's merge commit as the source. Include baseRefName in this query and skip unless it is main.
  .github/workflows/post-backport-checklist.yml:107
• When the last active branch disappears, render-checklist intentionally returns an empty body, but this early exit leaves COMMENT_ID untouched. The old checklist can then continue to show stale checked branches and remain eligible for auto-backport processing; delete the existing comment when COMMENT_ID is non-empty before exiting.
  .github/workflows/validate-yaml-dashboards.yml:172
• This extracts only the first path segment after packages/. For a supported nested package such as packages/technology/p1/_dev/shared/kibana, it compiles into packages/technology/kibana/dashboard instead of packages/technology/p1/kibana/dashboard, so valid nested-package dashboards are reported as out of sync. Derive the package root by removing /_dev/... from input_dir.
  cmd/backport/backports/apply/apply.go:703
• commitOwnerSync stages manifest.yml before it stages CODEOWNERS and may fail after either operation. git checkout -- restores the worktree from the index, so it preserves any staged owner changes instead of restoring HEAD; a best-effort sync failure can therefore leave a partial staged change and prevent the caller from returning to a clean branch. Restore both the index and worktree from HEAD (for example with git restore --source=HEAD --staged --worktree -- ...).
  cmd/backport/backports/apply/apply.go:943
• A full branch target is accepted based only on the generic regex; it is never checked against packageName. This allows --package aws --target backport-prometheus-6.14 to resolve and apply an AWS commit onto Prometheus' backport branch. Validate full targets with backports.ValidateBranchName(packageName, target) before returning them.
  cmd/backport/backports/apply/apply.go:214
• On the successful non-dry-run path this checks out the original branch but never deletes workingBranch, even though the cleanup comment says retries should not fail with “branch already exists” and the next comment says local presence is no longer needed. A second invocation with the same SHA in the same checkout therefore fails at checkout -b; delete the local working branch after successfully restoring the original branch.
  cmd/backport/backports/packages/detect.go:35
• The changed paths passed by git diff --name-only use /, while filepath.Separator is \ on Windows and ListPackagesWithNames returns OS-native paths. On Windows this makes every strings.HasPrefix check fail, so detect-packages and check-owners can silently report no packages; normalize both sides with filepath.ToSlash before comparing.
  cmd/backport/main.go:51
• The documented order allows backport check-active <branch> --json, but Go's flag.FlagSet stops parsing when it reaches <branch>, so --json is treated as an extra positional argument and JSON output is silently disabled. Document the supported flag-before-argument order (or use a parser that accepts both orders).
  cmd/backport/main.go:56
• The usage text places --json after the positional arguments, but runDetectPackages uses Go's flag.FlagSet, which stops parsing at the first positional argument. Following this documented form therefore emits plain output instead of JSON; show the supported flag-before-argument order (or change parsing to accept both).
  dev/scripts/backport_apply.sh:53
• usage() always exits 1, so -h|--help reports failure and the wrapper's help command cannot succeed. Pass an explicit zero status for the help case (while retaining status 1 for invalid/missing arguments).

• Files reviewed: 174/193 changed files
• Comments generated: 5
• Review effort level: Lite