Publish cosign-signed GitHub Releases - #18

What

Adds .github/workflows/release.yml, publishing GitHub Releases for v* tags:

• Builds 4 static musl binaries (amd64/arm64 x minimal/full) via the image's own
  Dockerfile builder stage, so released binaries byte-match the published image.
• Signs each with cosign keyless (.sig/.pem) and attests SLSA provenance via
  actions/attest-build-provenance (GitHub artifact attestations).
• A single release job creates the release and attaches assets (no race); a
  workflow_dispatch ref input backfills an existing tag.

Scorecard

Moves Signed-Releases from 0 to 8/10 (the .sig file satisfies the signed probe).

Not 10/10: the provenance probe keys on a *.intoto.jsonl file that only the
deprecated slsa-github-generator emits, and it requires tag-pinning (violates
this repo's SHA-pinning invariant). Provenance is instead delivered via GitHub
artifact attestations, which scorecard does not yet recognize. Recorded in
docs/standards.md.

Notes

• Hardening: end-anchored tag validation, tags: ['v[0-9]*'], idempotent backfill.
• Backfill: after merge, workflow_dispatch with ref=v0.3.0 publishes the first signed release.
• Also ignores docs/plan/ (orchestration artifacts) in .gitignore.