Per-artifact template variable keys (set inside per-artifact loops in
stage-sbom, stage-sign, stage-checksum). Bundled into a constant so the
“set, render, clear” pattern stays in one place — when an additional var
gets added (e.g. ArtifactPath), every consumer picks it up.
Clear both PER_TARGET_VARS and PER_ARTIFACT_VARS on exit from a
per-artifact loop. Mirrors clear_per_target_vars but covers the larger
surface that sbom/sign/checksum loops touch — preventing the “stale
ArtifactName from sbom run leaking into announce” class of bug.
Extract the extension from an artifact filename, including compound
extensions like .tar.gz, .tar.xz, .tar.zst, .tar.bz2, .tar.lz4,
.tar.sz. Returns the extension with a leading dot (e.g. .tar.gz, .exe,
.dmg), or an empty string if there is no extension.
Render a previously-registered Tera template with ctx, returning the
rendered string. Stage label is included in the error context so a render
failure surfaces as <stage>: render '<name>': <tera-msg> rather than a
panic.