Make the release scripts actually run

[wu-sheng]

Ran tools/releasing/release.sh for the first time. It failed. So did the next two attempts. All three defects below were found by executing the scripts, not by reading them — they had been written and reviewed in #194/#196 but never run.

1. release.sh died silently right after preflight's first line

=== Preflight ===
  version 5.0.0 (from chart/skywalking/Chart.yaml)
$ echo $?
1

No error message. preflight ended on:

git rev-parse "${TAG}" >/dev/null 2>&1 && die "tag already exists"
svn ls "${SVN_DEV_URL}/helm/${VERSION}" >/dev/null 2>&1 && die "already uploaded"

On the normal path both left sides fail — the tag doesn't exist, the version isn't staged. set -e is exempt for the left side of an && list, which is why the construct looks safe in isolation. But the list's non-zero status becomes the function's return value, and preflight is called as a bare statement, so set -e kills the run there.

Both are now if-form, which returns 0 when the condition is false.

This has been present since the script was added, so preflight had never once completed. It is the same shape as the bug that killed the swck release script.

2. The temp-dir cleanup guaranteed exit 1 and leaked every run

trap 'rm -rf "${workdir}"' EXIT over a local workdir. A trap runs after the function has returned and cannot see a local, so under set -u the trap itself failed — status 1 on the success path, and the directory holding the signed artifacts was never removed. The variable and trap are now both at script scope.

The earlier RETURN trap had the mirror-image flaw: right scope, but RETURN doesn't fire when set -e kills the shell mid-function.

3. The Linux-only guard was obsolete

Added when make clean was a backslash-continued rm whose later -rf tokens sat mid-argument-list — GNU rm permutes those, BSD rm doesn't. That recipe is now a single rm -rf over one operand list, which both accept. The guard outlived its reason and blocked a working path.

Verified by running, not reading

release.sh --dry-run, pristine clone, macOS: exit 0, all nine stages, both signatures verify under gpg --batch --verify, both checksums under shasum -c, packaged chart renders 33 resources, all six artifacts staged for svn, no temp dir left behind.

release-passed.sh against a local svnadmin repo mirroring the real layout (staged 5.0.0 in dev; 4.9.0/ plus loose 4.8.0 files in release):

Run	Result
--dry-run	walks every stage, exit 0, changes nothing
decline the promotion	aborts, dev and release both unchanged
accept, accept, decline gh	all 6 files moved dev→release, 4.9.0/ and the loose 4.8.0 file removed, aborted before creating the release

macOS build path: make clean exits 0 and removes everything; make release-src produces a tarball with no AppleDouble, .DS_Store, .git or build artifacts; make release signs and checksums all six files.

Nothing was uploaded to dist.apache.org and no tag was pushed — the svn work happened in a throwaway checkout, and svn add is local until svn commit. Confirmed against the server: dist/dev/skywalking/helm/ is still empty.