feat(release): goreleaser + tag-driven release workflow + install.sh (CLI-MCP-13R2)

[mastermanas805]

Closes CLI-MCP-13R2 (BugBash QA round 2 strategic gap).

Why

Until this PR, the CLI had no release pipeline. `go install` was the only documented install path — it requires a Go toolchain and pins users to whatever HEAD happens to be. Meanwhile every other backend service in instanode.dev auto-builds on push (CLAUDE.md rule 15). The CLI was the odd one out.

What changes

Three coordinated pieces:

`.goreleaser.yml`

• Cross-compiles darwin / linux × amd64 / arm64 + windows amd64.
• Binaries are ldflag-stamped with the tag version, short commit SHA, and UTC build time — matches the Makefile's `make build` so `instant --version` keeps the CLAUDE.md rule 14 build-SHA gate workable on release binaries.
• SBOM (CycloneDX via syft) ships alongside each archive.
• `checksums.txt` is signed by sigstore cosign via keyless OIDC.

`.github/workflows/release.yml`

• Fires on `v*..` tag push.
• Third-party actions are SHA-pinned per CSO supply-chain policy:
  • `goreleaser/goreleaser-action@e435ccd…` (v6.4.0)
  • `sigstore/cosign-installer@398d4b0…` (v3.7.0)
  • `anchore/sbom-action/download-syft@e22c389…` (v0.20.0)
• First-party `actions/checkout` and `actions/setup-go` use `@v6` to match the rest of the repo (matches `ci.yml`, `coverage.yml`, etc.).
• `GITHUB_TOKEN` is the per-job repo-scoped token — no long-lived PAT.
• `id-token: write` granted only at the goreleaser job for sigstore keyless signing.

`install.sh`

• POSIX `sh` (not bash) so curl-pipe-sh works on Debian/Ubuntu (dash), macOS (bash), Alpine (busybox).
• Detects OS / arch via `uname`, resolves the latest release via the GitHub API (or honors `INSTANT_VERSION=v0.2.0`).
• Downloads the matching `.tar.gz`, verifies SHA-256 against the release's signed `checksums.txt`.
• Installs to `/usr/local/bin` (override via `INSTANT_INSTALL_DIR`). Sudo is requested explicitly only when the target dir isn't writable.
• Windows users are pointed at the release page `.zip`.
• shellcheck-clean.

README updated: `curl -sSfL https://instanode.dev/install.sh | sh` is the primary path; `go install` is the fallback.

Verification

• `goreleaser check` — config valid against GoReleaser v2.16.
• `goreleaser release --snapshot --skip=sign,sbom,publish` — all 5 archives build clean (darwin amd64/arm64, linux amd64/arm64, windows amd64).
• `bin/instant --version` on the snapshot binary prints `0.0.1-next (4cd4678, …)` — ldflag stamping works end-to-end.
• `sh -n install.sh` — POSIX syntax OK.
• `shellcheck install.sh` — zero warnings.
• `make ci` — green.

Follow-up (not in this PR)

• Cut `v0.2.0` tag after merge to fire the first release.
• Wire `https://instanode.dev/install.sh\` to redirect to the raw GitHub script (tracked separately so this PR doesn't block on instanode-web push perms).
• Homebrew / Scoop / apt taps — when there's signal that one-liner install isn't enough.

🤖 Generated with Claude Code