Add CI and tagged release workflows

[thaodangspace]

Closes #8

Summary

• add macOS Go CI for formatting, vet, tests, race tests, and amd64/arm64 builds
• add Node 22 documentation CI with npm cache and short-lived build artifact
• add least-privilege tagged GoReleaser releases with checksums, SBOMs, Homebrew token validation, and artifact provenance
• make make check include the CLI build

Verification

• make check
• make test-race
• make docs-build
• make snapshot

[thaodangspace]

One release-safety issue to address:

The PR CI never validates the newly changed GoReleaser configuration or the release workflow path. The successful CI run only covers Go checks and the docs build, so errors in sboms, the Homebrew publisher, or the release command will first surface after pushing a v* tag—at which point the release may already be partially published.

Please add a non-publishing PR check such as goreleaser check plus goreleaser release --snapshot --clean (with the Homebrew publisher disabled/skipped for snapshots if necessary). This will make the release configuration testable before a tag is created.

[thaodangspace]

Addressed in commit 9fca35b:

• added a PR release-config job running GoReleaser check and a non-publishing release --snapshot --clean
• installed Syft in CI so snapshot SBOM generation is exercised
• migrated the deprecated Homebrew Formula publisher to homebrew_casks

Local validation: goreleaser check and make snapshot pass.