feat(release): v0.4.0 foundations — ldflags version + goreleaser + CI Go 1.24

- Move version out of cmd/root.go hardcode into an ldflags-injected
  var. Makefile derives from 'git describe --tags --always --dirty';
  plain 'go build' / 'go run' get 'dev'. Release builds will get the
  tag via goreleaser.
- Add .goreleaser.yaml: multi-platform (linux/darwin/windows/freebsd ×
  amd64/arm64/arm) builds with SHA256 checksums, tar.gz/zip archives,
  forgejo release publishing. No GPG/S3 yet — deferred until a key is
  provisioned.
- Add .gitea/workflows/release.yml to run goreleaser on tag push.
  Uses built-in GITEA_TOKEN with override via RELEASE_TOKEN secret.
- Align CI Go version with go.mod (1.24). Previously CI ran 1.21,
  which would have silently missed any 1.22+ feature use.
- Move itchyny/gojq from indirect to direct (it's used in api.go).
  Drop stale x/sys v0.33.0 entry from go.sum.
- Ignore dist/ and bin/ in .gitignore.
- CHANGELOG: document v0.3.1 fix and Unreleased development changes.

go.mod

@@ -4,6 +4,7 @@ go 1.24.0
 
 require (
 	code.gitea.io/sdk/gitea v0.22.1
+	github.com/itchyny/gojq v0.12.18
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/viper v1.19.0
 	golang.org/x/term v0.32.0
@@ -19,7 +20,6 @@ require (
 	github.com/hashicorp/go-version v1.7.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/itchyny/gojq v0.12.18 // indirect
 	github.com/itchyny/timefmt-go v0.1.7 // indirect
 	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect