Add GitHub Actions release workflow for self-contained executables

[sassdawe]

Implements Option 1 from DISTRIBUTION.md: publish self-contained, single-file executables to GitHub Releases when a \�*\ tag is pushed.

Changes

• **New .github/workflows/release.yml**: builds win-x64, osx-arm64, osx-x64, and linux-x64 self-contained single-file binaries, smoke-tests each with --help, zips them, and attaches them to a GitHub Release via \softprops/action-gh-release.
• **\AtsScanner.Cli.csproj**: enabled \PublishReadyToRun\ (faster startup) and \InvariantGlobalization\ (smaller footprint; verified no \CultureInfo/culture-dependent code is used).
• Bugfix found via manual testing of the published executable: running \scan\ with default/verbose output crashed with \Error: Could not find color or style 'Content'\ and exit code -1. The issue category name (e.g. \Content) was being interpolated directly into Spectre.Console markup as [Content], which Spectre parsed as a style tag rather than literal brackets. Fixed by escaping it as literal text.

Testing performed

• \dotnet build\ and \dotnet test\ (121/121 passing) both before and after the fix.
• Locally published a real self-contained single-file win-x64 executable (\dotnet publish -r win-x64 --self-contained true -p:PublishSingleFile=true).
• Generated a sample .docx\ resume and ran the published \�ts-scanner.exe\ against it:
  • --help\ and --version\
  • default \scan\ (table summary) — previously crashed on the details view, now exits 0
  • --verbose\ full report across all 11 platforms — now exits 0
  • --output json\ for a single platform — valid JSON produced
  • error path (missing file) — prints a friendly error and exits 1 as expected

[Copilot]

Pull request overview

Adds automated GitHub Releases packaging for the CLI and fixes a Spectre.Console markup crash encountered in published binaries, aligning the repo with the “self-contained executable” distribution path.

Changes:

• Added a tag-triggered GitHub Actions workflow to publish self-contained, single-file binaries for multiple RIDs, smoke-test with --help, zip, and attach to a GitHub Release.
• Enabled PublishReadyToRun and InvariantGlobalization for the CLI project to optimize published executables.
• Fixed scan output crashing due to unescaped [ / ] in Spectre.Console markup by escaping the rendered issue category label.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/AtsScanner.Cli/Commands/ScanCommand.cs	Escapes the issue category label so it renders literally and doesn’t get parsed as a Spectre.Console style tag.
src/AtsScanner.Cli/AtsScanner.Cli.csproj	Turns on publish/runtime options intended to improve self-contained release binaries (R2R + invariant globalization).
.github/workflows/release.yml	Implements the tag-based multi-RID publish + zip + GitHub Release asset upload workflow.