[backport-cloud_security_posture-2.0] Sync CI configuration with main branch - #21277

This PR synchronizes CI configuration, Go tooling, and backport automation from main to the backport branch.

Changes:

• Updates Buildkite and GitHub Actions workflows.
• Adds backport tooling for ownership, changelogs, inventories, and checklists.
• Updates package discovery and testing; removes legacy test-reporter code and fixtures.

Final review status: unresolved critical and moderate findings remain.

Suppressed comments (12)

.buildkite/scripts/packages/security_detection_engine.sh:98

• When the semver filter finds no matching active versions, read -a still creates STACK_VERSIONS, so ${STACK_VERSIONS+x} is set and this guard is false. The loop then runs zero times and the script exits successfully without reporting that OOM testing was skipped; test the array length instead.
  .buildkite/scripts/test_integrations_with_serverless.sh:101
• These grep -q pipelines run with pipefail inherited from common.sh. For a sufficiently large diff, grep can exit after the first match and the producer gets SIGPIPE, so an affected package is incorrectly omitted from PACKAGE_LIST. Use the non-early-exiting grep -E ... > /dev/null form used elsewhere in common.sh.
  .buildkite/scripts/trigger_integrations_in_parallel.sh:70
• These grep -q pipelines run with pipefail inherited from common.sh. When changed_files is large, grep exits after the first match and echo can receive SIGPIPE, making the if condition false and omitting an affected package from the generated test pipeline. Use the non-early-exiting grep -E ... > /dev/null pattern used elsewhere in common.sh (and avoid grep -q here).
  .github/workflows/post-backport-checklist.yml:107
• When all active branches disappear, render-checklist returns an empty body, but this path leaves the existing checklist comment untouched. A PR can therefore continue displaying stale branches after inventory archival/expiry, even though the renderer says stale sections should disappear; delete the existing marked comment when NEW_BODY is empty.
  .github/workflows/validate-yaml-dashboards.yml:172
• This derives the output path from only the first directory below packages. For nested packages such as packages/technology/foo/_dev/shared/kibana, it writes/compares against packages/technology/kibana/dashboard instead of the package's packages/technology/foo/kibana/dashboard, so nested dashboard changes are validated against the wrong location. Derive the package root from input_dir rather than taking one path segment.
  cmd/backport/backports/changelog/comment.go:103
• workingBranch is always slash-containing (for example changelog/pr-42) but is interpolated directly into the REST path. GitHub treats that slash as a path separator, so this lookup returns not-found for the sync branch and the failure comment omits the manual compare link; URL-encode the branch name or use an API form that accepts it as a parameter.
  cmd/backport/backports/owners/compare.go:126
• CODEOWNERS has a /packages/ @elastic/integrations-triaging default rule, so source.Resolve(pkgPath) succeeds even when the package was removed from main. The subsequent parseManifestOwners then errors on the missing origin/main:<package>/manifest.yml, contrary to this function's documented normal-skip behavior for removed/renamed packages. Check that the source manifest exists (or otherwise distinguish the package-specific rule from the default) before parsing it.
  cmd/backport/backports/packages/detect.go:35
• files comes from git diff --name-only, which uses / separators, while filepath.Separator is \\ on Windows. This makes every prefix comparison fail on Windows, so detect-packages and check-owners report no packages even when package files changed. Normalize both the discovered paths and Git paths with filepath.ToSlash before comparing.
  cmd/backport/main.go:316
• diffPackages maps only paths under packages/, so a backport PR whose only ownership change is .github/CODEOWNERS produces an empty pkgs list here and exits successfully. The Buildkite pipeline explicitly runs this check when .github/CODEOWNERS changes, so that case currently bypasses the owner-sync enforcement; include the affected/all package names for a global CODEOWNERS change (or otherwise resolve the changed CODEOWNERS entries).
  dev/scripts/backport_apply.sh:53
• --help dispatches to usage, which always exits with status 1, so a successful help request is reported as a command failure. Handle -h/--help with a zero exit status separately from usage on invalid or missing arguments.
  dev/scripts/backport_bootstrap_inventory.sh:49
• The usage function always exits with status 1, so the -h) usage; exit 0 ;; branch never reaches exit 0; requesting help is reported as a failure. Make the help path return status 0 while keeping invalid-option paths nonzero.
  dev/scripts/backport_bootstrap_inventory.sh:324
• This branch-filter regex only permits lowercase letters and underscores in the package portion. Real package names such as m365_defender, o365_metrics, and 1password contain digits, so their existing backport-* branches are silently excluded from the generated inventory. Accept the same package-name characters as the inventory validator (at least [a-zA-Z0-9_]+).

• Files reviewed: 173/195 changed files
• Comments generated: 6
• Review effort level: Lite