fix(securebuild): install schemahero rqlite plugin in the migrations image

schemahero 0.25 loads the rqlite driver as a go-plugin binary. When it
isn't found in a local search path, schemahero falls back to downloading
the plugin from an OCI registry, which hangs in the no-network
schemahero-apply init container and left kotsadm stuck in Init, failing
the e2e suite.

The schemahero-0.25-rqlite apk installs the plugin to
/var/lib/schemahero/plugins/schemahero-rqlite (a default search path), but
declaring it only as a melange subpackage runtime dep didn't reliably land
it in the image. Install it explicitly in the apko image packages and set
SCHEMAHERO_PLUGIN_PATH so discovery always finds the bundled plugin and
never attempts a download.

Reproduced locally with the schemahero 0.25.1 CLI + rqlite plugin: with the
plugin absent it attempts a download; with it present at the search path,
plan and apply both run against rqlite and create all 24 tables with no
download.

Also reverts a stale, unrelated change to release.yaml that had undone the
!cancelled() job guards added on main.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: kriscoleman

securebuild/image/apko-kotsadm-migrations.yaml

@@ -5,13 +5,24 @@ contents:
     - https://apk.cve0.io/key/cve0-signing.rsa.pub
   packages:
     - kotsadm-migrations
+    # schemahero 0.25 loads the rqlite driver as a go-plugin binary. If it isn't
+    # present locally, schemahero tries to download it from an OCI registry,
+    # which hangs in a no-network init container. Install it explicitly so it's
+    # on disk at /var/lib/schemahero/plugins/schemahero-rqlite (a default search
+    # path) and no download is ever attempted.
+    - schemahero-0.25-rqlite~0.25.1
     - bash
     - busybox
     - securebuild-baselayout
     - curl
     - git
     - ca-certificates-bundle
 
+# Point schemahero at the bundled plugin so discovery never falls back to a
+# network download. Redundant with the default search paths, but explicit.
+environment:
+  SCHEMAHERO_PLUGIN_PATH: /var/lib/schemahero/plugins
+
 paths:
   - path: /schemahero
     type: symlink