ci: add tag-driven release workflow

[fheikens]

Summary

Adds a complete release workflow (.github/workflows/release.yml) triggered on v* tag pushes. Implements all six gates from the Elevarq release protocol.

Release pipeline

v* tag push
  → validate (CHANGELOG check)
  → test (Go tests, boundary tests)
  → lint (hadolint)
  → security-scan (Trivy fs + config + image, gitleaks)
  → publish (GHCR push, cosign sign, SBOM)
  → build-binaries (cross-compile linux/darwin x amd64/arm64)
  → release (GitHub Release with binaries, checksums, SBOM)

Gates enforced

Gate	Tool	Blocks release?
A. Correctness	Go tests, boundary tests	Yes
B. Lint	hadolint	Yes
C. Security	Trivy (CRITICAL/HIGH), gitleaks	Yes
D. Supply chain	Pinned actions, version injection, GHCR	Yes
E. Artifact	cosign signing, SBOM, cross-compiled binaries	Yes
F. Hygiene	CHANGELOG validation, release notes	Yes

Release artifacts

• Container image: ghcr.io/elevarq/arq-signals:<version>
• Go binaries: arq-signals + arqctl for linux/darwin x amd64/arm64
• SHA256 checksums
• SBOM (SPDX JSON)
• Cosign signature (keyless, GitHub OIDC)

How to release

# 1. Update CHANGELOG.md, CITATION.cff
# 2. Commit and push to main
# 3. Tag and push
git tag -a v0.3.0 -m "Release v0.3.0"
git push origin v0.3.0

🤖 Generated with Claude Code