fix(ops): ignore -linux-* suffixes when fetching distroless image tags

[bwplotka]

Ignore -linux-* architecture-specific tag suffixes when searching for latest distroless tags in gmpctl.

[gemini-code-assist]

Code Review

This pull request refactors the gmpctl release automation tool, simplifying dependency management by installing tools locally to .bin/, removing the NVD API key requirement and severity-based sorting for vulnerability checks, and adding a -skip-tag-signing flag. Feedback on these changes includes addressing a performance bottleneck by avoiding redundant go install executions, correcting non-standard hyphen escaping in grep filters, and fixing inconsistent indentation and global EXIT trap usage in lib.sh.

[avilevy18]

LGTM!

AI mentioned a minor nit regarding the .bingo/variables.env trap cleanup in release-lib::manifests_regen():

Using a RETURN trap (trap '...' RETURN) in Bash functions automatically executes cleanup whenever the function finishes or returns (on both success or failure). This avoids needing trap - EXIT or touching process-wide EXIT traps:

if [[ -f "${dir}/.bingo/variables.env" ]]; then
    cp "${dir}/.bingo/variables.env" "${dir}/.bingo/variables.env.bak"
    trap 'mv "${dir}/.bingo/variables.env.bak" "${dir}/.bingo/variables.env" 2>/dev/null || true' RETURN
    echo "#!/bin/bash" >"${dir}/.bingo/variables.env" # Clean the file.
fi

Non-blocking, feel free to keep as-is or adjust.