fix: repair fork CI and stop false-green test runs

[EhabY]

Repair fork CI so it builds and tests this fork's own code, and stop the test wrapper from reporting failures as passes.

• Upgrade AWS S3 dependencies and Staticcheck; refresh generated files and depaware inventories.
• Make cmd/testwrapper fail on build, setup, and package failures, including tests that time out without a final event, while still retrying marked flaky tests. Each package result is printed once, and timeout panics are no longer dropped.
• Run the Windows tests through cmd/testwrapper so marked flaky tests are retried there too.
• Fuzz this fork's targets with ClusterFuzzLite instead of building upstream through OSS-Fuzz.
• Fix license headers and the empty-interval connstats assertion, upgrade artifact uploads, restrict job permissions, and allow the upstream-only vm job to be skipped.

Decisions and validation

• feature/s3/manager is only used by the upstream VM test, but upgrading it forces aws-sdk-go-v2/config v1.18 → v1.32, which ipn/store/awsstore uses at runtime. coder already builds with config v1.33.1, so its resolved version is unchanged.
• Staticcheck v0.7.0 handles the unsigned bounds checks emitted by the current stringer, avoiding an older generator pin.
• Fuzzing stays blocking: four targets, 300-second budget. build.sh copies GOROOT because the v2 fuzz builder patches testing internals and must match the declared Go toolchain.
• Build failures rely on the package fail event that Go 1.24+ always emits, so there is no separate build-fail handling. The wrapper drops go test's own ok/FAIL/? lines for a package and prints its summary (with the attempt number) instead; other package output, such as init panics, is still printed.
• go test attributes a package timeout panic to the last resumed parallel test, even one that already passed. The wrapper now prints output that arrives after a test's own --- PASS/--- SKIP line instead of buffering it into logs that are never shown.
• The Windows job ran plain go test, so net/connstats TestConcurrent (marked flaky, net/connstats: flake in TestConcurrent tailscale/tailscale#7030) failed 2 of the last 25 Windows jobs. It never needed a retry in 75 Linux test jobs, where the wrapper already retries marked tests. Like the Linux bench all step, Windows now prints benchmark results only when a benchmark fails.
• TestCLI runs the real wrapper against fixture modules that use the repo's go version: pass, invalid flags, compile error, flaky retry, flaky plus compile error, non-flaky failure, timeout, timeout after a parallel pass (without -v, as CI runs), and flaky plus timeout. It also checks that each package result appears once. The flaky-plus-timeout, timeout-after-parallel-pass, and single-summary checks fail without their fixes.
• CI passes on this head; only the upstream-only vm job is skipped.

Generated with Coder Agents on behalf of @EhabY.

[ethanndickson]

👍