ci: enforce provider boundaries in pure build mode

[hdwhdw]

Summary

• add the pure build tag to the existing pure-package path
• compile packages and tests with CGO_ENABLED=0 before race tests
• restrict pure build tags to direct internal adapter provider files
• declare direct dependencies exposed by current mechanical package discovery

Validation at commit 21bf9058

• make -f pure.mk ci passes for 17 packages
• go mod tidy -diff reports no changes
• AMD64, ARM64, memory, pure, static, CodeQL, and Semgrep checks passed
• integration passed all 1,279 tests in builds 1201604, 1201690, and 1202463
• each run then failed during coverage-tool installation on the shared /tmp/go permission boundary

Blocker

• blocked by build: separate Go caches from project tools #767
• PR 767 removes the shared Go cache boundary and passed full upstream CI build 1202340
• after PR 767 merges, this branch will rebase onto current master and rerun unchanged

Relationship

• first delivery commit from non-mergeable umbrella draft build: integrate changes for pure build mode (do not merge) #764
• the database-config adapter follows only after this PR is green and merged

Tracking: Azure DevOps Task 39387055.

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[hdwhdw]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[hdwhdw]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).