cli-v1.0.0

Gate the CLI release on the test suite

The release workflow runs a test job first (API vitest suite + CLI go vet/build)
and the build/publish job needs it, so a cli-v* tag only produces a release when
tests pass.