ci: add automated release workflow

[altaywtf]

Changed

• Adds semantic-release config for tag-only Go module releases on master.
• Adds a release job after the existing test and quality jobs pass.
• Uses only the built-in GitHub Actions bot token with contents: write permission.
• Removes tag-triggered CI runs so release-created tags do not cause duplicate workflow runs.
• Documents the release model in docs/RELEASE.md.

Risks

• The first merge after this lands should create v1.7.3 because fix: improve ValidateToken invalid response handling (#8) is still newer than the latest v1.7.2 tag.
• semantic-release is configured for master, matching the current repository branch.
• No GoReleaser or package-registry publishing is configured; Go module publishing remains git-tag based.

Complexity

• Neutral: release automation is isolated to GitHub Actions, .releaserc.json, and release docs.

Verification

• actionlint
• mise exec go@1.26.2 -- go test -v ./...
• mise exec go@1.26.2 -- go test -race -count=1 ./...
• mise exec go@1.26.2 golangci-lint@2.11.3 -- golangci-lint run ./...
• jq . .releaserc.json

[Copilot]

Pull request overview

This PR introduces automated, tag-based Go module releases on the master branch using semantic-release, integrated into the existing GitHub Actions CI pipeline.

Changes:

• Adds a semantic-release configuration (.releaserc.json) targeting master with Conventional Commits analysis and GitHub Release publication.
• Extends the CI workflow to run a gated release job after tests and linting pass, granting only contents: write for the release job.
• Documents the release and versioning model in docs/RELEASE.md.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
docs/RELEASE.md	Documents the intended automated release model, required token, and local verification checks.
.releaserc.json	Configures semantic-release branch and plugins for commit analysis and GitHub release publishing.
.github/workflows/ci.yml	Adds a post-CI release job on pushes to master and removes tag-triggered CI runs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.