fix(ci): revert SLSA builder to v2.0.0

[CybotTM]

Summary

• The v2.1.0 SLSA builder incorrectly detects the repository as private
• This causes all builds to fail with: "Repository is private. The workflow has halted..."
• The repository is public and private-repository: false is set
• Reverting to v2.0.0 which worked correctly for v0.17.0 release

Test plan

• Verify the release workflow completes successfully after this fix

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml	5a775b367a56d5bd118a224a811bba288150a563	🟢 7.4	Details Check Score Reason Maintained 🟢 6 1 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 6 Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Dependency-Update-Tool 🟢 10 update tool detected Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 4 dependency not pinned by hash detected -- score normalized to 4 CII-Best-Practices 🟢 5 badge detected: Passing Signed-Releases 🟢 10 5 out of the last 5 releases have a total of 5 signed artifacts. Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 10 SAST tool is run on all commits License 🟢 10 license file detected Branch-Protection ⚠️ 2 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 28 out of 28 merged PRs checked by a CI test -- score normalized to 10 Vulnerabilities ⚠️ 0 25 existing vulnerabilities detected Contributors 🟢 10 project has 29 contributing companies or organizations

Scanned Files

• .github/workflows/release-slsa.yml

[Copilot]

Pull request overview

This PR reverts the SLSA GitHub Generator from v2.1.0 to v2.0.0 to fix a CI failure where v2.1.0 incorrectly identifies the public repository as private, causing all release builds to fail despite private-repository: false being explicitly set.

• Reverts SLSA builder version from v2.1.0 (commit hash) to v2.0.0 (tag reference)