v0.5.0 - rebase onto pipeline 2.0.3 catalog overhaul

Switches all catalog includes to the v2.0.x catalog overhaul.
Container build collapses to a thin runtime layer over UBI micro
9.6 with the cosign-signed binary COPYd from go-release-binary's
dist/ output (provable byte-for-byte parity).

Multi-arch binary set: linux/amd64, linux/arm64, darwin/arm64.
Per-binary .sha256 sidecars. Container image is single-arch in
v0.5.0; multi-arch container in v0.5.1 once storr qemu support is
verified.

Lint hygiene: three hits previously masked by the v1.x catalog
docker.io/golangci-lint allow_failure pattern, all fixed.

CI: workflow:auto_cancel for MR pushes; smoke-immich and
drift-gate-immich moved off tag rules to web/api triggers only
(local make pre-tag-check is the actual tag-time gate for the
operator).

No user-facing CLI changes. The binary, archive format, and flags
are identical to v0.4.6.

See CHANGELOG.md for full notes.