What is the penalty of breaking the embargo? Not shipping patches anymore beforehand?

It might make other projects reconsider sharing advanced patches with Chainguard.

Nothing's gonna happen, just as with previous embargo breaks, people complain yet nobody involved gets punished

A mere digital slap on the wrist via "bad publicity".