build: publish verified multi-platform archives

[airouter-dev]

Summary

• add a tag-only release workflow for Linux, macOS, and Windows on AMD64/ARM64
• build the complete archive set twice and compare every byte before publishing
• attach a SHA-256 manifest and GitHub OIDC artifact attestations
• embed and validate the tag version, document verification, and add actionlint to CI

This is a distribution-only v0.1.2 patch. Runtime behavior and the oai-smoke/v1 output schema do not change.

Security boundaries

• GitHub Actions are pinned to immutable commit SHAs
• checkout credentials are not persisted
• the build job is read-only; only the tag-gated publish job receives contents: write, id-token: write, and attestations: write
• the workflow refuses a tag that does not match the source version and refuses to replace an existing release
• archives contain only the binary, MIT license, and English README

Validation

• go test ./...
• go test -race ./...
• go vet ./...
• GOTOOLCHAIN=go1.22.0 go test ./...
• GOTOOLCHAIN=go1.22.0 go vet ./...
• go run github.com/rhysd/actionlint/cmd/[email protected]
• local release script built all six targets twice; checksum manifests and each archive were byte-identical
• all tar/zip entry paths were inspected; no absolute paths or parent traversal
• targeted high-confidence secret scan: 0 findings