ci: publish furrow binaries for linux and macOS

[AbirAbbas]

Summary

furrow has no CI and no releases, so the only way to obtain the binary is cargo build --release from source. That makes it effectively unavailable to callers: AgentField's workspace-sync feature (Agent-Field/SWE-AF#130) hands out a handle that needs furrow on the caller's machine, and today the documentation has to tell people to compile Rust before they can use it.

This adds a release workflow so tagging cuts downloadable binaries.

Changes Made

• Build x86_64-unknown-linux-gnu, aarch64-apple-darwin, and x86_64-apple-darwin on tag push (v*) or manual dispatch against an existing tag.
• Assets are named furrow-<os>-<arch>, matching the convention AgentField already uses for vendored binaries.
• Natively-built targets get a --version smoke test; the cross-compiled x86_64-apple-darwin slice cannot run on the arm64 runner, so it is built but not executed.
• --locked builds, SHA256SUMS attached, release creation is idempotent (re-running uploads with --clobber instead of failing).
• No third-party actions beyond actions/checkout, upload-artifact, and download-artifact; the release itself is cut with the preinstalled gh CLI.

Windows is intentionally omitted. It is not a missing build target — 13 source files use std::os::unix (OsStrExt, MetadataExt, PermissionsExt, symlink) with zero cfg(windows) guards, so x86_64-pc-windows-msvc cannot compile. That is a source port with real semantic decisions (extended attributes, uid/gid, symlink handling) and belongs in its own change. Windows users reach furrow through WSL, which uses the linux asset.

Test Plan

• Workflow YAML parses
• Every run: block executed locally under CI's exact shell (bash --noprofile --norc -e -o pipefail) — checksum globbing, the idempotent create/upload branch, and the install -m 755 staging step all behave
• cargo metadata --locked succeeds, so --locked builds will not fail on a stale lockfile
• First real run happens on the first tag push

---

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}