Harden GitHub release workflow

[1337lean]

Summary

• add a SHA-pinned CodeQL workflow for Go
• split release verification, attestation, and publication into least-privilege jobs
• bind the remote tag and protected-main ancestry before publication
• hash and reverify the exact artifact handoff between jobs
• update provenance action pinning and complete third-party binary notices

Why

The published v0.1.1 implementation and artifacts are sound, but the next release path needed stronger job isolation, verified handoff integrity, and CodeQL coverage before branch protection is finalized.

Validation

• go test -race ./...
• go vet ./...
• Staticcheck v0.7.0
• govulncheck v1.6.0: no reachable vulnerabilities
• actionlint v1.7.12
• GoReleaser v2.17.0 check
• fresh six-target snapshot and release verifier

GitHub follow-up

After the new CodeQL check succeeds, protect main, require the current CI and CodeQL contexts, and enable private vulnerability reporting.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.