ci: archive the proto baseline from the api/proto subtree and retry the cvc5 download

[devin-ai-integration]

What and why

Both red jobs on develop at bd59ac7 are infrastructure, not code:

• Go static checks — make proto-breaking built the baseline with git archive HEAD^1 api/proto. A pathspec makes git archive walk the whole tree of HEAD^1, and on CircleCI's blobless (promisor) checkout that lazily fetches every blob the parent commit does not share with the checkout. The fetch goes to the promisor remote over SSH, which the executor cannot authenticate to, so the job died with Permission denied (publickey) / could not fetch … from promisor remote on a merge that touched no .proto file.

  Fix: archive the subtree as the tree-ish instead — git archive 'HEAD^1:api/proto'. Only that subtree's objects are read, and they are already present because the checkout's api/proto shares them. The archive root is now the proto directory, so buf breaking … --against "$baseline#format=tar" drops subdir=api/proto.

  -git archive --format=tar -o "$baseline" '$(BUF_BREAKING_REF)' api/proto
  -$(BUF) breaking api/proto --against "$baseline#format=tar,subdir=api/proto"
  +git archive --format=tar -o "$baseline" '$(BUF_BREAKING_REF):api/proto'
  +$(BUF) breaking api/proto --against "$baseline#format=tar"

• Go race tests — died in Install cvc5 on a single failed curl of the GitHub release asset. Added --retry 5 --retry-delay 5 --retry-all-errors; the SHA-256 pin is unchanged.

How it was verified

• Reproduced the failure in a local --filter=blob:none clone with the SSH promisor URL: the old pathspec form fetches and fails, the tree-ish form archives without any fetch and buf breaking reports ✓ No breaking schema changes.
• make proto-breaking BUF_BREAKING_REF=HEAD^1 and BUF_BREAKING_REF=origin/develop pass on this branch.
• python3 scripts/changelog.py check, gofmt -l ., go vet ./..., make lint, make build pass.
• The pipeline on this PR is the real test of both changes in the CircleCI executor.

Checklist

• make test and make lint pass locally
• Tests added or updated for the change (tooling only)
• Documentation extended where it already covers the surface (see CONTRIBUTING.md)
• Changelog entry added as changes/unreleased/<slug>.<section>.md, not as an edit to CHANGELOG.md
• baselines regenerated and make docs-counts run if a gate count moved (compliance rows need nothing: the census is counted at docs build)
• No internal work-item labels (waves, slices, F4, K5) in the body, docs, or changelog

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.