fix(ci): avoid caching unpublished Go module versions

[moonyue-w]

Summary

Release preflight queried the public Go proxy before creating a tag, caching an unknown revision for up to 30 minutes. The five-minute verification window then failed even though the tag had been published correctly.

Use the proxy's cached-only endpoint for both checks before tag publication, preserving the existing-publication conflict guard without fetching an unpublished tag. After publication, retain the normal public proxy and allow 35 minutes of retry delays within a 45-minute job timeout; print response headers and body on exhaustion. Document recovery and add offline shell-step regression tests.

Why

Prevents the failure seen in the v0.7.0 release. The original tag and approved SDK source remain unchanged. See the Go proxy FAQ for negative-cache behavior and the cached-only endpoint.

Verification

• make lint
• make build
• make test
• make docs-check
• go build ./examples/...
• Account-backed integration tests not required: release workflow only.

Commands and results:

python3 -m unittest discover -s .github/scripts -p 'test_*.py' -v: 25 passed
Ruby YAML parse of .github/workflows/release.yml: passed
git diff --check: passed
make lint / make build / make test: passed in a clean tracked-source copy
make docs-check / go build ./examples/...: passed in the Git checkout

Regression cases cover unpublished and uppercase prerelease versions, an existing cached version with a missing tag, idempotent tag reuse, proxy errors, recovery after a simulated 30-minute miss, and bounded failure diagnostics. Tests execute the workflow shell steps with fake Git/HTTP/clock commands; they perform no publishing or real waits.

Impact

• Public API or behavior changed
• Changelog not applicable: CI-only fix; no SDK package changes.
• Generated API documentation updated
• Forward/Managed contract fixtures updated
• Python and TypeScript parity considered: Go proxy behavior only.
• Migration notes added for a breaking change
• No credentials, .env.live, logs, or generated test output committed

API documentation, contract fixtures and migration notes are unchanged because this only changes release automation. Approval, immutable tag checks, source-SHA validation and public consumer compilation remain enforced.