Harden release artifact validation

[1337lean]

What changed

• validate ELF, Mach-O, and PE executable type and architecture for all six release targets
• fully read required archive entries so ZIP CRC failures cannot pass validation
• reject empty required packaged assets
• add regression coverage for wrong-target binaries, empty assets, and corrupt ZIP contents
• add a least-privilege, SHA-pinned CodeQL workflow
• document the stronger release guarantees

Why

The prior release gate executed only the host-native archive. A malformed non-host executable or a corrupt required ZIP entry could therefore pass the pre-publication validator after its outer checksum was recomputed. The repository also had no GitHub code-scanning analysis.

Validation

• go test ./...
• go test -race ./...
• go vet ./...
• Go 1.25 test/build compatibility
• Staticcheck v0.7.0
• govulncheck v1.1.4
• Actionlint v1.7.12
• GoReleaser v2.17.1 configuration check
• six-target snapshot build plus releasecheck

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.