Add release workflow with reproducible builds

Adds .github/workflows/release.yml triggered on v* tags. Builds
linux/amd64 and linux/arm64 with -trimpath, CGO_ENABLED=0, and
SOURCE_DATE_EPOCH set from the tag commit — the three flags required
for Debian-compatible reproducible Go builds. Uploads binaries and a
sha256sums.txt to the GitHub Release via softprops/action-gh-release.

Wires a version variable in main.go (defaulting to "dev") that is
stamped at build time via -ldflags "-X main.version=<tag>". The
Makefile gains the same flags for local builds (VERSION ?= dev).

0 files changed, 0 insertions, 0 deletions