[STAC-25486] Finish process-agent CVE remediation

[LouisLotter]

Summary

• align all OpenTelemetry modules on 1.44.0 and upgrade klauspost/compress to 1.18.7
• refresh patched BCI packages and verify the packaged process-agent on amd64 and arm64
• replace the retired GitLab pipeline with GitHub build, unit, smoke, Trivy secret/vulnerability, and Grype checks
• publish and sign immutable multi-architecture images only from master; PRs build and scan locally

GO-2026-5932 remains covered by the reviewed package-scoped VEX analysis in StackVista/vexhub#29.

Validation

• both architecture builds, unit tests, image smoke tests, and VEX-aware scans passed in the previous run
• uvx zizmor --collect=workflows,actions,dependabot . reports no findings
• git diff --check

Jira: https://stackstate.atlassian.net/browse/STAC-25486

[LouisLotter]

Latest validation: run 30340992193 built and smoke-tested the amd64 and arm64 BCI images successfully. GO-2026-5841 is gone after the klauspost/compress upgrade. The scan now reports only CVE-2026-50195, CVE-2026-53489, CVE-2026-53492, and GO-2026-5932; all four are covered by the approved, green StackVista/vexhub#29. The obsolete required GitLab status is addressed by StackVista/pulumi-infra#245, which still needs infra review and apply. After those two PRs land, rerun this PR CI; no further process-agent code changes are expected.

[Andreagit97]

Should we remove all .gitlab CI files? if i understand well, we don't need them anymore

[LouisLotter]

Addressed the GitLab cleanup in 47efb12b: removed the archived GitLab pipeline files and GitLab-only Cerberus hooks. The environment helper was still referenced by DEVELOPMENT.md, so it has been retained as scripts/set_environment.sh and the documentation now points there.

[LouisLotter]

Review changes are applied and validated in run 30353115824. Both amd64 and arm64 passed the combined generated-code/build/test job, BCI image build and smoke test, Trivy secret scan, and VEX-aware Trivy + Grype vulnerability scan. GO-2026-5932 is now recorded as a scoped, expiring repository exception for the unpublished-image scan; released-image scans continue to use the reviewed VEX hub statement. The only remaining failures are the two publish jobs reporting Username and password required. StackVista/pulumi-infra#245 provisions those Quay credentials and replaces the obsolete GitLab required status; it remains open and review-required, and must be merged and applied before this PR can become fully green.