feat!: unify CalmsToolkit CLI and delivery pipeline

[calmcacil]

Summary

• replace the standalone media tools with one Linux-focused calmstoolkit Cobra CLI
• centralize runtime injection, config precedence, terminal/machine rendering, HTTP behavior, watch behavior, diagnostics, and exit handling
• preserve SSH-friendly Unicode/color views while adding plain, JSON, and NDJSON output contracts
• add secure required PR validation, dependency review, CodeQL, pinned actions, Dependabot, Release Please, and GoReleaser
• reset public release history to start at v1.0.0 and add the MIT license

Breaking changes

The old binaries are removed. Use these commands instead:

• media-streams -> calmstoolkit streams
• media-calendar -> calmstoolkit calendar
• media-requests -> calmstoolkit requests
• media-airtime -> calmstoolkit airtime
• arr-feed -> calmstoolkit feed
• anisearch -> calmstoolkit anime
• calmstoolkit-setup -> calmstoolkit config setup

The full migration guide is in docs/user/MIGRATION_UNIFIED_CLI.md.

CI and release design

Required checks are designed as:

• CI / Quality
• CI / Tests
• CI / Linux builds
• CI / Vulnerabilities
• Security / Dependency review
• Security / CodeQL (Go)

Release Please maintains a human-reviewed semantic release PR from squash-merged Conventional Commit titles. After that PR is manually merged, GoReleaser attaches Linux amd64/arm64 archives and checksums. Release authentication uses a short-lived, repository-scoped GitHub App token; it does not use a PAT or privileged default token.

Validation

• go mod tidy and go mod verify
• go vet ./...
• golangci-lint v2.12.2 (0 issues)
• go test -race -count=1 -covermode=atomic ./...
• govulncheck v1.6.0 ./... (no reachable vulnerabilities)
• Linux amd64 and arm64 builds
• actionlint v1.7.12
• goreleaser v2.12.7 check
• command registration/documentation and architecture-boundary checks
• immutable action-pin and common credential-pattern checks

Maintainer setup before merge

• Review docs/CI_AUDIT.md, docs/CI_RELEASES.md, and docs/CI_MIGRATION.md.
• Make the repository public when ready; it is currently private, so public-repository security features and free public-runner behavior do not yet apply.
• Install the release GitHub App with Contents and Pull requests read/write permissions only.
• Add RELEASE_APP_ID and RELEASE_APP_PRIVATE_KEY Actions secrets.
• After the new checks have reported, configure the documented main protection/ruleset and squash-only merge settings.

This PR should not be merged until the release App secrets and public-repository transition are ready.

[calmcacil]

CI bootstrap result: Quality, Tests, Linux builds, and Vulnerabilities all pass on Go 1.25.12. Security / Dependency review and Security / CodeQL (Go) are failing only because GitHub reports that Dependency Review and code scanning are unavailable while this repository remains private without GitHub Advanced Security. Make the repository public, enable the dependency graph/code scanning features, and rerun Security before merge.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.