fix(ci): repair v12 deploy pipeline (Go backend, collectors, enterprise artifacts)

The PR squash-merged into release/v12.0.0 carried the clobbered v11-architecture
pipeline (Maven/Java backend, user-auditor & web-pdf services, utmstack-collector
path, config/modules-config plugins; reusable-golang stripped of build_context/
dockerfile inputs). This restores the correct v12 build graph:

- backend builds via reusable-golang.yml (Go, context=repo root, backend/Dockerfile)
- drop user-auditor & web-pdf
- collectors/{utmstack,as400,forwarder}
- event processor builds the 16 Go plugins of event_processor.Dockerfile
- enterprise artifacts (entitlements, as400-collector.jar, utmstack-collector-mac)
  via private UTMStackEnterprise releases (ENTERPRISE_ARTIFACTS_VERSION_*)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Kbayero

.github/workflows/reusable-golang.yml

@@ -12,6 +12,26 @@ on:
       flags:
         required: false
         type: string
+      build_context:
+        required: false
+        type: string
+        default: ""
+        description: "Docker build context (defaults to ./<image_name>)"
+      dockerfile:
+        required: false
+        type: string
+        default: ""
+        description: "Path to the Dockerfile (defaults to ./<image_name>/Dockerfile)"
+    secrets:
+      API_SECRET:
+        required: false
+        description: "Token to fetch private github.com/utmstack Go modules. Optional; when unset, only public modules are fetchable (backwards-compatible)."
+      CM_SIGN_PUBLIC_KEY:
+        required: false
+        description: "Optional value baked into the binary via ldflags. The `secrets` context is not allowed in a caller's `with:`, so secret-derived ldflags must be passed here and referenced from `inputs.flags` as $CM_SIGN_PUBLIC_KEY."
+      CM_ENCRYPT_SALT:
+        required: false
+        description: "Optional value baked into the binary via ldflags. Reference from `inputs.flags` as $CM_ENCRYPT_SALT."
 jobs:
   build:
     name: Build
@@ -26,12 +46,27 @@ jobs:
           go-version: ^1.20
         id: go
 
+      - name: Configure git for private modules
+        run: |
+          if [ -n "${{ secrets.API_SECRET }}" ]; then
+            git config --global url."https://${{ secrets.API_SECRET }}:x-oauth-basic@github.com/".insteadOf "https://github.com/"
+            echo "GOPRIVATE=github.com/utmstack" >> $GITHUB_ENV
+            echo "GONOPROXY=github.com/utmstack" >> $GITHUB_ENV
+            echo "GONOSUMDB=github.com/utmstack" >> $GITHUB_ENV
+          fi
+
       - name: Running Tests
         working-directory: ./${{inputs.image_name}}
         run: go test -v ./...
 
       - name: Build Binary
         working-directory: ./${{inputs.image_name}}
+        env:
+          # Exposed so `inputs.flags` can reference them with shell expansion
+          # ($CM_SIGN_PUBLIC_KEY / $CM_ENCRYPT_SALT). The `secrets` context can't
+          # be used in the caller's `with:`, only in a step like this one.
+          CM_SIGN_PUBLIC_KEY: ${{ secrets.CM_SIGN_PUBLIC_KEY }}
+          CM_ENCRYPT_SALT: ${{ secrets.CM_ENCRYPT_SALT }}
         run: |
           if [ -n "${{inputs.flags}}" ]; then
             go build -o ${{inputs.image_name}} -v -ldflags "${{inputs.flags}}" .
@@ -49,6 +84,7 @@ jobs:
       - name: Build and Push the Image
         uses: docker/build-push-action@v6
         with:
-          context: ./${{inputs.image_name}}
+          context: ${{ inputs.build_context != '' && inputs.build_context || format('./{0}', inputs.image_name) }}
+          file: ${{ inputs.dockerfile != '' && inputs.dockerfile || format('./{0}/Dockerfile', inputs.image_name) }}
           push: true
           tags: ghcr.io/utmstack/utmstack/${{inputs.image_name}}:${{inputs.tag}}