Release: publish checksummed macOS and Linux CLI archives

[sraodev]

Summary

The repository has a source-preview release but no native assets for the canonical ubt command, its ubtctl compatibility alias, or the required ubtd daemon. Secure curl, mise, and Homebrew installation all need one deterministic, checksummed release contract first.

• Build the existing three programs for macOS and Linux on AMD64 and ARM64.
• Publish four stable-named archives plus checksums.txt from approved version tags.
• Reject invalid tags and commits outside master history before publishing.
• Exercise the complete archive contract in non-publishing pull-request CI.

Closes #40.

Review scope

This PR contains three focused commits: release implementation, complete archive-manifest verification, and the checked-in reviewer package.

The change does not alter CLI or daemon behavior. It does not create a release, publish a tag, or add an installer. Curl, mise, Homebrew, the stable installer URL, signing, Windows distribution, and hardware qualification remain separate work.

Attached review documents

• Release assets scope — included and excluded work, ordered source review, invariants, failure behavior, rollout gates, and evidence limits.
• GoReleaser contract — binaries, targets, stable archive names, contents, checksums, and version injection.
• Release workflow — tag grammar, master ancestry guard, pinned tooling, and job-scoped write permission.
• CI snapshot contract — non-publishing build, exact archive-member comparison, and checksum verification.

Reviewer roadmap

SVG · Mermaid source

Sequence diagram — guarded tag to release assets

SVG · Mermaid source

Architecture diagram — source entry points, artifact contract, publication, and follow-ups

SVG · Mermaid source

What changed

• adds a GoReleaser v2 configuration for ubt, ubtctl, and ubtd
• cross-builds the matching executable set for macOS/Linux on AMD64/ARM64
• publishes one stable-named tarball per OS/architecture plus checksums.txt
• embeds the release tag in CLI and daemon version fields
• adds a tag-only release workflow with an explicit semantic tag grammar
• refuses to publish a tag whose commit is outside origin/master history
• limits contents: write to the publishing job and pins every action by commit
• adds a non-publishing snapshot job that checks all four archives, their exact five-member manifests, and every checksum
• ignores local dist/ output

Verification

Passed locally on macOS/ARM64:

goreleaser check
goreleaser release --snapshot --clean
gofmt -l .
go vet ./...
go test -race ./...
go build ./...
python3 scripts/smoke.py
python3 -m unittest discover -s examples/chat -p 'test_*.py' -v
git diff --check

All four generated archives passed their SHA-256 checksums and exact member comparison. The generated macOS ARM64 ubt version --client-only, ubtctl version --client-only, and ubtd --help commands ran successfully. Workflow YAML and release-tag valid/invalid cases were checked.

All three Mermaid sources passed the pinned Mermaid 11.12.0 renderer. Their PNGs were visually inspected; editable SVG and Mermaid sources are checked in.

Important limits and remaining gates

This PR does not publish a GitHub Release. After merge, a maintainer must explicitly approve and create a version tag, inspect the resulting four archives and checksums.txt, and independently verify a downloaded archive before announcing it.

The archives are not code-signed, notarized, attested, or accompanied by an SBOM. Snapshot CI does not prove installation across operating-system versions, macOS trust behavior, Bluetooth hardware behavior, or future installer/package-manager integration. Those remain separate reviewed gates in #41, #42, #43, and #44.