ci: fix coverage cgo runtime loading

[XuPeng-SH]

What this fixes

MatrixOne coverage UT linked every CGo test binary against the checkout-local libmo.so, but only embedded the third-party library directory in ELF RUNPATH. Go executes test binaries under /tmp/go-build..., so the dynamic loader could not find libmo.so and the complete coverage run failed before tests started.

This change:

• embeds both $GITHUB_WORKSPACE/cgo and thirdparties/install/lib in the temporary test binaries runtime search path;
• derives libmo native dependencies from MatrixOne cgo/lib.go instead of maintaining another partial hard-coded library list;
• preserves archive-safe link order: -lmo before its queried dependency closure.

Verification

Using PR matrixorigin/matrixone#27480 source in a clean Linux/arm64 container with LD_LIBRARY_PATH unset:

• old flags: binary linked, ELF RUNPATH omitted /workspace/cgo, execution failed with status 127 (libmo.so not found);
• new flags: ELF RUNPATH included /workspace/cgo, execution passed with status 0.

Also checked with actionlint (excluding the workflows existing custom-runner/context diagnostics), YAML parsing, and git diff --check.

Related: matrixorigin/matrixone#27480.

[XuPeng-SH]

Closing after the #27480 scope correction. The native/CGo link-contract changes were removed from matrixorigin/matrixone#27480, which now uses the existing main CI contract and does not require this companion workflow change. Native dependency-closure hardening can return as a separately scoped MatrixOne + CI change.