gen circleci: bump orb to the GOCACHE release + parallel arch builds at large resource_class for cli repos

[teemow]

Resolution (2026-06-23) — DONE

Shipped and rolled out:

• devctl PR feat(gen): parallel six-arch build at large resource_class for cli repos #2028 (feat(gen): parallel six-arch build at large resource_class for cli repos) merged 2026-06-23, released as v8.21.1 (chore(release): v8.21.1 #2029). OrbVersion bumped to the architect-orb release carrying Update module golang.org/x/net to v0.22.0 #838; cli-flavour go-build gets build_concurrency: auto + resource_class: large; golden testdata regenerated; no signing/nancy changes.
• align-files pin bumped to 8.21.1 in giantswarm/github#5484 (released v0.58.1), flowing the change org-wide.

All acceptance criteria met. Tracking issue giantswarm/giantswarm#36941 closed at the same time.

---

Problem

The generated go-build job is the slow critical-path gate on every ci.generate: true Go repo
(11-14 min on muster; every downstream job requires: go-build). The dominant fix -- persisting
$GOCACHE -- is implemented in giantswarm/architect-orb#838 (open, CI-green, measured 5.1x warm on
muster: 392.6s -> 76.4s; projected ~12 min -> ~1.5 min for the six-arch cli config). This issue is the
devctl-side follow-up to roll #838 to all generated Go repos and to address the remaining cold
cross-compile cost.

Out of scope (decided): no signing changes (signing stays always-on) and no nancy changes (nancy stays
always-on; architect-orb#844's optional-nancy is not adopted).

Proposed solution

After architect-orb#838 is merged and released:

1. Bump OrbVersion in pkg/gen/input/circleci/circleci.go to the architect-orb release carrying Update module golang.org/x/net to v0.22.0 #838.
2. In pkg/gen/input/circleci/internal/file/workflows.yml.template, for cli-flavour repos (the
   six-arch matrix, {{- if .ReleaseBinaries }} block) set the orb's build_concurrency: auto and
   resource_class: large on the go-build job, so the cold (post-go.sum-bump) six-arch
   cross-compile parallelises across cores instead of running sequentially on 2 vCPUs. Update module golang.org/x/net to v0.22.0 #838's
   build_concurrency is opt-in precisely because it only pays at a larger resource_class.
3. Regenerate the golden testdata fixtures (pkg/gen/input/circleci/testdata/*.workflows.yml).

Open question: a generated resource_class: large default for cli repos vs a gen.ci.resourceClass
knob. A default is simpler and matches the derive-don't-configure model; a knob can follow if a repo
needs to opt out.

Acceptance criteria

• OrbVersion points at the architect-orb release containing Update module golang.org/x/net to v0.22.0 #838.
• Generated workflows.yml for a cli-flavour repo sets build_concurrency + resource_class: large
  on go-build.
• No signing or nancy parameter changes in the generated config.
• Golden testdata regenerated; circleci_test.go passes.
• A devctl release is cut so the new pin can flow into giantswarm/github align-files.

Context

Follow-up to giantswarm/architect-orb#838 (Tier 1, done). Rolls out org-wide via the devctl pin in
giantswarm/github align-files. Full analysis + decisions: internal lab notebook
(architecture/go-build-ci-performance.md, ADR 2026-06-20-1633).