Toward the bottom of the page they talk about contributing back to open source projects and sponsoring the development of some packages, so it certainly appears to be a curated set of existing Go libraries.
> If the former, how are they going to guarantee their "3 years of bug fixes"?
Red Hat provides 10+ years on the code they ship. What's so shocking about 3?
Does Red Hat ship (and maintain) arbitrary 3rd party code?
I don't know what you mean by "arbitrary", though. It makes no sense in context, and is notably at odds with your earlier use of the word "curated". Nobody ships random code. That wouldn't be curated, nor would it be useful.