ci: auto-cut releases on merge to main

[statik]

Summary

Automatically cuts a release on every merge to main, following the posit-dev/vip technique adapted for this Go repo.

• version.yml (new) — on push to main, computes the next semver from Conventional Commits with mathieudutour/github-tag-action (dry-run), then calls the build pipeline in the same run. No tag is pushed and nothing is committed back to main, so no PAT/deploy key is needed and there is no release loop.
• build/ci/clamp_version.sh (new, unit-tested) — keeps the project in 0.x until 1.0.0 is shipped deliberately: a feat!:/breaking change bumps the minor (0.1.0 → 0.2.0), not 1.0.0.
• release.yml (refactored) — now reusable via workflow_call. The auto path publishes the release (draft → all assets uploaded → checksums → flip to published), so it never goes public half-built. Manual workflow_dispatch and tag-push paths still produce a draft for review.
• pr-title.yml (new) — lints PR titles as Conventional Commits. Because the repo squash-merges, the PR title becomes the commit subject the versioner reads.

Bump rules: fix: → patch, feat: → minor, breaking → minor (clamped in 0.x). A docs:/chore:-only merge cuts no release.

Versioning behavior

Merge	Result
feat: …	minor (0.1.0 → 0.2.0)
fix: …	patch (0.1.0 → 0.1.1)
feat!: … / BREAKING CHANGE	minor, clamped to 0.x (not 1.0.0)
docs:/chore: only	no release

Test Plan

• go test ./... passes (no Go code changed)
• build/ci/clamp_version_test.sh — 8/8 cases (incl. 0.9.0→0.10.0 arithmetic, minor=0, patch-digit ignored)
• actionlint clean on all workflows; shellcheck/shfmt clean on scripts
• zizmor clean on the new workflows (the one secrets-inherit on version.yml is intentional — the reusable build needs the optional signing secrets)
• First post-merge feat:/fix: PR produces a published release with macOS/Windows/Linux assets + checksums
• A docs:-only merge produces no release
• A non-conventional PR title fails the PR Title check

Notes

• Pre-existing zizmor debt in release.yml's build jobs (unpinned first-party setup-go@v5, setup-go cache-poisoning, top-level contents: write) is left as-is — out of scope here. Happy to sweep it in a follow-up.
• Requires the repo's squash-merge setting to use the PR title as the commit subject (default) for the version computation to read conventional commits.

https://claude.ai/code/session_01JzTDM3mjWKS2XWbTFixBnk

[statik]

Superseded by #32, which recreates this against the Tauri/Rust main (the Go code this was built on was removed in the v2 migration).