…potency

Extract duplicated logic into release/lib.sh and fix 13 issues found
during release-script audit. Verified with dry-run of fictional 26.3.1
patch release across docker-images, airflow-operator, and commons-operator.

| #  | Finding                                  | Fix                                                        |
|----|------------------------------------------|------------------------------------------------------------|
|  1 | Partial failure with no recovery         | PR branch resume, idempotent changelog, no-diff re-runs    |
|  3 | -w not validated                         | validate_what() in lib.sh, all 5 scripts                   |
|  4 | Tag/branch format validation inconsistent| Shared validate_tag() / validate_release(), consistent regex|
|  5 | Inconsistent dependency checks           | check_build_dependencies() vs check_basic_dependencies()   |
|  6 | Branch-existence grep is loose           | ls-remote --heads (no local refs); anchored regex fallback  |
|  7 | git commit -sam captures unintended files| Explicit git add in create-rc for products and operators    |
|  8 | No dirty-index check                     | require_clean_worktree in lib.sh, called in 3 functions    |
| 10 | cd without return / cwd drift            | All per-repo functions wrapped in subshells (...)           |
| 12 | check_tag_is_valid implicit cwd          | Takes explicit repo_dir parameter; all callers updated     |
| 13 | Stale branch lists in tag script         | ls-remote --heads replaces fetch + local branch inspection  |
| 15 | Minor inconsistencies                    | REPOSITORY→REMOTE, usage strings, validate_tag in merge-rc |
| 17 | create-release-branch ignores existing   | warn_if_branch_exists + check_existing_branches            |
| 18 | libgit2 dynamic linking                  | LIBGIT2_NO_PKG_CONFIG=1 in create-rc                       |
| 19 | git fetch destroys local tags            | All fetch+inspect replaced with git ls-remote              |

Additional: verify_release (8 pre-commit checks), for_each_operator,
idempotent update_changelog, ensure_clone/ensure_temp_folder,
derive_tag_vars/derive_branch_vars, opensearch-operator in image-checks.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Apply the same refactoring patterns from the other release scripts:

| Change                            | Before                              | After                                    |
|-----------------------------------|-------------------------------------|------------------------------------------|
| Shared library                    | Duplicated REMOTE, RELEASE_REGEX    | source lib.sh                            |
| Input validation                  | Inline regex, no -w check           | validate_release(), validate_what()      |
| Quote stripping                   | Inline parameter expansion          | strip_quotes()                           |
| Variable derivation               | Manual RELEASE_BRANCH, DOCKER_…     | derive_branch_vars()                     |
| Temp folder                       | Inline mkdir -p                     | ensure_temp_folder()                     |
| Repo cloning                      | Inline clone-or-reuse logic         | ensure_clone() + require_release_branch()|
| Operator iteration                | Inline while-read loop              | for_each_operator()                      |
| cwd isolation                     | Bare cd (cwd drift risk)            | Subshells (...) in all repo functions    |
| PR state across subshells         | CREATED_PRS bash array              | Temp file (PR_LOG_FILE) via mktemp+trap  |
| Cleanup                           | Local function with parameter       | lib.sh cleanup() using TEMP_RELEASE_FOLDER|
| Dependency check                  | None                                | check_basic_dependencies (git user + gh) |
| Error output                      | echo to stdout                      | >&2 echo for errors                      |
| Usage string                      | Said "create-release-branch.sh"     | Corrected to "release-branch-hygiene.sh" |
| Typo                              | "did't"                             | "didn't"                                 |
| No-op commit guard                | Missing (git commit always ran)     | git diff --cached --quiet && return      |

WORK_BRANCH timestamped naming, raise_pr() with commits-ahead check,
print_summary(), and interactive UBI prompt preserved unchanged.

Verified: two consecutive dry-runs (-w operators, release-26.3) without
cleanup — both passed, second run reused existing clone correctly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>