ci: add comprehensive GitHub Actions CI/CD pipeline

[jwilder]

Summary

Replace the existing build and release workflows with a modern, best-practices CI/CD setup.

• CI pipeline (ci.yml): golangci-lint v2, tests with race detection + coverage, govulncheck, cross-platform build matrix (linux/darwin × amd64/arm64)
• CodeQL (codeql.yml): security analysis on push, PR, and weekly schedule
• Release pipeline (release.yml): manual workflow_dispatch with patch/minor/major dropdown — auto-bumps version in README.md and examples, commits, tags, builds multi-arch Docker images (amd64+arm64) to GHCR via GoReleaser
• GoReleaser (.goreleaser.yml): 13 platform/arch builds + 3 alpine builds, tar.gz archives, checksums, changelog with conventional commit filtering
• Linting (.golangci.yml): golangci-lint v2 config with govet, staticcheck, ineffassign, unused (errcheck disabled pending fix of 16 pre-existing violations)
• Dependabot: added github-actions ecosystem alongside existing gomod
• Dockerfile: now injects version via -ldflags so dockerize --version works in containers
• Makefile: simplified — delegates dist/release to GoReleaser, keeps local dev targets (lint, test, build)

Files changed

Action	File	Purpose
Create	.github/workflows/ci.yml	CI: lint, test, vulncheck, build matrix
Create	.github/workflows/codeql.yml	CodeQL security analysis
Create	.golangci.yml	golangci-lint v2 configuration
Create	.goreleaser.yml	GoReleaser v2 release configuration
Create	Dockerfile.goreleaser	Minimal distroless image for GoReleaser Docker builds
Replace	.github/workflows/release.yml	Manual release with version bump + GoReleaser
Edit	.github/dependabot.yml	Add github-actions ecosystem
Edit	Dockerfile	Inject version via build arg + ldflags
Edit	Makefile	Remove dist/release targets (now GoReleaser)
Delete	.github/workflows/build.yml	Superseded by ci.yml

Validation

• golangci-lint run ./... — 0 issues
• go test -v -race ./... — 11/11 pass
• goreleaser check — config validated
• go build — compiles cleanly

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.