feat(release): v0.4.0 foundations — ldflags version + goreleaser + CI Go 1.24

- Move version out of cmd/root.go hardcode into an ldflags-injected
  var. Makefile derives from 'git describe --tags --always --dirty';
  plain 'go build' / 'go run' get 'dev'. Release builds will get the
  tag via goreleaser.
- Add .goreleaser.yaml: multi-platform (linux/darwin/windows/freebsd ×
  amd64/arm64/arm) builds with SHA256 checksums, tar.gz/zip archives,
  forgejo release publishing. No GPG/S3 yet — deferred until a key is
  provisioned.
- Add .gitea/workflows/release.yml to run goreleaser on tag push.
  Uses built-in GITEA_TOKEN with override via RELEASE_TOKEN secret.
- Align CI Go version with go.mod (1.24). Previously CI ran 1.21,
  which would have silently missed any 1.22+ feature use.
- Move itchyny/gojq from indirect to direct (it's used in api.go).
  Drop stale x/sys v0.33.0 entry from go.sum.
- Ignore dist/ and bin/ in .gitignore.
- CHANGELOG: document v0.3.1 fix and Unreleased development changes.

.gitea/workflows/ci.yml

@@ -15,7 +15,7 @@ jobs:
       - name: Set up Go
         uses: https://github.com/actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.24'
           cache: true
 
       - name: Install golangci-lint
@@ -34,7 +34,7 @@ jobs:
       - name: Set up Go
         uses: https://github.com/actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.24'
           cache: true
 
       - name: Build application
@@ -49,7 +49,7 @@ jobs:
       - name: Set up Go
         uses: https://github.com/actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.24'
           cache: true
 
       - name: Run unit tests
@@ -66,7 +66,7 @@ jobs:
       - name: Set up Go
         uses: https://github.com/actions/setup-go@v5
         with:
-          go-version: '1.21'
+          go-version: '1.24'
           cache: true
 
       - name: Build production binary