chore(release): plugin-version discipline (workflow#758)

[intel352]

Summary

Per workflow#758 Layer 3 — mechanical migration mirroring the canonical DO plugin pattern shipped at GoCodeAlone/workflow-plugin-digitalocean#165.

• Delete .github/workflows/sync-plugin-version.yml — sync mechanism retired; goreleaser before-hook + binary ldflag carry release-tag truth.
• plugin.json.version → "0.0.0" sentinel (flat M.m.p, ParseSemver-compatible).
• plugin.json.minEngineVersion → 0.61.0 (requires sdk.ResolveBuildVersion + IaCServeOptions.BuildVersion from workflow v0.61.0).
• plugin.json.downloads: archive-name shape switched from workflow-plugin-aws_VERSION_OS_ARCH.tar.gz → workflow-plugin-aws-OS-ARCH.tar.gz to mirror DO. Release tag now embedded only in /releases/download/<tag>/ path; filename no longer carries version.
• cmd/workflow-plugin-aws/main.go: passes sdk.ResolveBuildVersion(internal.Version) to IaCServeOptions.BuildVersion. Binary runtime version surfaces via GetManifest RPC even when committed plugin.json shows the sentinel.
• provider.ProviderVersion: const → var so the -ldflags -X override actually takes effect (const is build-time, not link-time). Default "dev" in unit tests.
• internal.Version = "dev": new var so the second goreleaser ldflag drives the runtime version surfaced via sdk.ResolveBuildVersion (previously dead-referencing a nonexistent symbol).
• .goreleaser.yaml: adopt canonical .release/plugin.json rewrite pattern (rm + cp + sed for version + tag-path; wfctl plugin validate --strict-contracts pre-build). Archive name_template flattened to {{ .ProjectName }}-{{ .Os }}-{{ .Arch }}.
• release.yml: setup-wfctl@v1 pinned to v0.61.0 + pre-build wfctl plugin validate-contract --for-publish + post-build --release-dir verification.
• ci.yml: bump strict-contracts wfctl pin v0.20.1 → v0.61.0 (v0.20.1 cannot validate the new sentinel + minEngineVersion).
• Bump workflow pin v0.57.0 → v0.61.0.
• provider/provider_test.go: stop asserting hardcoded "1.0.0"; compare against provider.ProviderVersion.

Test plan

• GOWORK=off go build ./... — green
• GOWORK=off go test ./... -count=1 — all green
• Local wfctl plugin validate-contract . — PASS
• Local wfctl plugin validate-contract --for-publish --tag v0.0.1 . — PASS
• release.yml gates fire on next vX.Y.Z tag push (post-merge)

Per-repo variance vs DO

• Two ldflag-target packages (provider.ProviderVersion + internal.Version) instead of one — both retained per existing goreleaser config; internal.Version is the one consumed by sdk.ResolveBuildVersion.
• provider.ProviderVersion had to be converted from const → var (DO never had a const).
• internal.Version did not exist; added.
• AWS .goreleaser.yaml retains windows GOOS (DO is linux+darwin only).
• AWS has no equivalent of DO's TestPluginDownloadsMatchGoReleaserArchives URL-vs-version test, so no test retirement was required (host_conformance_test.go is module/step parity only — orthogonal).

Rollback

Revert PR. Restores sync workflow + workflow pin + version string. Pure-additive forward; revert is clean.

🤖 Generated with Claude Code