I1 [DOCS/build] Distribution readiness — --version fallback + release.yml + README quickstart

[espadonne]

Summary

Three pieces of distribution prep gating the v0.x.0 cut:

• I1: shithub --version printed dev (unknown) built unknown from any build that didn't go through the Makefile (notably go install github.com/.../cmd/shithub@vX.Y.Z). Added build.Resolved() which prefers the ldflags-set values (Make/goreleaser path) and falls back to runtime/debug.ReadBuildInfo() for go install-style builds. After v0.1.0 tags, go install ...@v0.1.0 will report shithub 0.1.0 (a1b2c3d4) built 2026-… instead of the dev sentinels.
• I31: added .github/workflows/release.yml so tag-push automatically runs goreleaser. Pins goreleaser-action@v6 with version: '~> v2' so we track v2 patch updates without unattended major bumps. Includes a make build && ./bin/shithub --version smoke step before goreleaser fires, so a broken ldflags chain fails fast before artifacts upload.
• I30: README quickstart expanded — added go install path, browser --web auth flow, daily-driver verbs (pr list, pr view, pr checkout, issue create, repo view --web), and a "differences from gh" section.

Test plan

• TestResolvedFallsBackToBuildInfo — verifies the fallback returns VCS metadata when debug.ReadBuildInfo provides it. Skips gracefully when VCS info isn't available (test-binary edge case).
• Existing TestPrintVersionHuman + TestPrintVersionJSON updated to source from build.Resolved() so the assertion accounts for the enrichment.
• make ci clean (build + test + lint + fmt-check + vet + spdx-check + ci-windows leg unchanged).
• Reviewer cuts a v0.0.1-rc.0 tag in a fork and confirms release.yml produces the goreleaser artifacts.
• Reviewer runs go install github.com/tenseleyFlow/shithub-cli/cmd/shithub@HEAD after this merges and confirms shithub --version reports the commit short-sha (not "unknown").

Notes / deferred

• Homebrew tap / scoop / .deb: README references brew install tenseleyFlow/tap/shithub but the tap itself ships in C25 (Distribution sprint). The README is honest about this — the v0.x.0+ section is gated on C25.
• SLSA provenance / signing: deferred to C27 (beta hardening). v0.x.0 ships unsigned tarballs.
• Worktree quirk: Go's -buildvcs=auto doesn't follow gitdir: pointers from a worktree's .git file, so a binary built directly from a worktree still shows dev (unknown) built unknown. Doesn't affect production paths (go install, fresh clone, goreleaser CI all work correctly).

Once this lands, I7a (server response shape) becomes the critical path.