fix: restore static linux release builds

[rianjs]

No description provided.

[rianjs]

Findings

1. Medium: the new dependency guard is too exact-match and can miss the same regression shape if it re-enters through a subpackage. In .github/workflows/ci.yml, go list -deps emits import paths, but the grep -E '^(github.com/byteness/keyring|github.com/1password/onepassword-sdk-go)$' check only fails on the module root names. If a future change pulls in github.com/byteness/keyring/... or github.com/1password/onepassword-sdk-go/..., this guard will pass even though the static Linux graph has regressed again. Matching module prefixes, not just the exact root package names, would close that hole.

No other material test-coverage or verification gaps stood out in this PR.
Addressed in the latest push by changing the CI dependency guard to match module prefixes: (github.com/byteness/keyring|github.com/1password/onepassword-sdk-go)(/|$). The local equivalent of the static guard passed after the change.

[rianjs]

Architect review: STATUS: clean

No findings. The PR is scoped to the cli-common v0.2.2 consumer bump plus an appropriate CI guard for the CGO=0 release targets. The Linux dependency graph guard checks both shipped Linux architectures and matches forbidden module prefixes; retained ByteNess/1Password entries in go.sum are expected from non-static build paths and not a release-safety issue.

[monit-reviewer]

Automated PR Review

Reviewed commit: 991cf76

Summary

No issues found.

2 PR discussion threads considered.

---

Completed in 17s | $0.20 | sonnet | daemon 0.2.121 | Glorfindel

Field	Value
Model	sonnet
Reviewers	hybrid-synthesis, harness-engineering:harness-architecture-reviewer, harness-engineering:harness-enforcement-reviewer, harness-engineering:harness-knowledge-reviewer
Engine	claude · sonnet
Reviewed by	pr-review-daemon · monit-pr-reviewer
Duration	17s wall · 26s compute (Reviewers: 8s · Synthesis: 7s)
Cost	$0.20
Tokens	69.5k in / 1.0k out
Turns	4

Per-workstream usage

Workstream	Model	In	Out	Cache read	Cache create	Cost
hybrid-synthesis	sonnet	33.2k	286	18.6k	14.6k (1h)	$0.07
harness-engineering:harness-architecture-reviewer	sonnet	12.1k	220	2.1k	10.0k (1h)	$0.04
harness-engineering:harness-enforcement-reviewer	sonnet	12.1k	270	2.1k	10.0k (1h)	$0.04
harness-engineering:harness-knowledge-reviewer	sonnet	12.1k	227	2.1k	10.0k (1h)	$0.04

_{Re-reviews only run when @monit-reviewer is re-requested as a reviewer — push as many commits as you need, then re-request when ready. PRs targeting branches other than main, master are skipped, even when @monit-reviewer is re-requested.}