feat(release): v0.4.0 foundations — ldflags version + goreleaser + CI Go 1.24

- Move version out of cmd/root.go hardcode into an ldflags-injected
  var. Makefile derives from 'git describe --tags --always --dirty';
  plain 'go build' / 'go run' get 'dev'. Release builds will get the
  tag via goreleaser.
- Add .goreleaser.yaml: multi-platform (linux/darwin/windows/freebsd ×
  amd64/arm64/arm) builds with SHA256 checksums, tar.gz/zip archives,
  forgejo release publishing. No GPG/S3 yet — deferred until a key is
  provisioned.
- Add .gitea/workflows/release.yml to run goreleaser on tag push.
  Uses built-in GITEA_TOKEN with override via RELEASE_TOKEN secret.
- Align CI Go version with go.mod (1.24). Previously CI ran 1.21,
  which would have silently missed any 1.22+ feature use.
- Move itchyny/gojq from indirect to direct (it's used in api.go).
  Drop stale x/sys v0.33.0 entry from go.sum.
- Ignore dist/ and bin/ in .gitignore.
- CHANGELOG: document v0.3.1 fix and Unreleased development changes.

.gitea/workflows/release.yml

@@ -0,0 +1,36 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  goreleaser:
+    runs-on: codeberg-small
+    steps:
+      - name: Checkout code
+        uses: https://github.com/actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Fetch tags
+        run: git fetch --force --tags
+
+      - name: Set up Go
+        uses: https://github.com/actions/setup-go@v5
+        with:
+          go-version: '1.24'
+          cache: true
+
+      - name: Run GoReleaser
+        uses: https://github.com/goreleaser/goreleaser-action@v6
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          args: release --clean
+        env:
+          # Forgejo Actions injects GITEA_TOKEN for the workflow by default;
+          # override with RELEASE_TOKEN secret if a longer-lived token is needed.
+          GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.GITEA_TOKEN }}
+          GORELEASER_FORCE_TOKEN: gitea