fix(check-catalog-info): stage before diffing so drift is actually detected

[ricky-undeadcoders]

check-catalog-info.yaml has never worked. It runs make catalog-info.yaml and then:

git diff --staged --exit-code

--staged compares the index against HEAD, and nothing in the job is ever git added — so the diff is always empty and the check passes unconditionally, whatever the generator produced.

What that let through

catalog-info.yaml had drifted by 338 lines. 18 of 39 actions were missing from the catalog entirely , so they never appeared in Backstage:

annotate-coverage, azure-trusted-signing, cleanup-branches, component-change-detection, create-github-app-token, docker-build-push-image, docker-export-digest, docker-import-digests-push-manifest, download-branch-workflow-artifact, go-flaky-tests, issues-update-project-status, run-capslock, signed-commits-info, socket-export-sbom, validate-renovate-config, validate-zizmor-config, wait-for-docker-publish, zizmor-collection-paths

The fix, in two parts

1. Stage before diffing (.github/workflows/check-catalog-info.yaml):

   - name: Check for drift
     run: |
+      git add -A
       if ! git diff --staged --exit-code; then

git diff alone would have covered modified files but still missed newly created ones — which is the case that actually mattered here, since a brand-new action has no catalog entry to modify. Also switched the failure to ::error:: so it surfaces as an annotation rather than a line in the log.

2. Normalize the generator's trailing newline (scripts/generate-catalog-info/main.go).

This part is not cosmetic — without it the fixed check fails on every PR. writeYAML appends a blank line after each document, which reads well between them but leaves a trailing one at EOF, so the generator emits \n\n. The committed file has a single \n, because pre-commit's end-of-file-fixer had been quietly stripping the extra one before every commit.

That mismatch was invisible while the check was broken. Once the check works, CI regenerates the file, gets \n\n back, and the diff shows a one-byte change — so it would have gone from never failing to never passing. I hit exactly this in CI on the first push of this PR.

normalized := append(bytes.TrimRight(output.Bytes(), "\n"), '\n')

Applied at the write site so the - (stdout) path gets the same treatment.

Verification

• Simulated the fixed check against the drifted tree: correctly fails.
• pre-commit run end-of-file-fixer --files catalog-info.yaml: Passed.
• Two consecutive make catalog-info.yaml runs: byte-identical.
• Regenerated file parses as 39 documents / 39 components, no duplicates.
• actionlint, gofmt, go vet: clean.

Notes

Of the 351 changed lines, 17 are the actual fix — the rest is generated catalog content clearing three months of accumulated drift.

Found while working on #2276, which added an equivalent drift check for action docs. That one already uses git add -A && git diff --staged --exit-code, and hit the same "generated output must satisfy the formatter" problem with prettier — worth remembering that any generate-and-diff check has both failure modes.

Touches no release-please package, so no version bumps.