build: add GoReleaser config + release automation (v0.1.0 version embedding)

[jflowers]

What Changed

Add GoReleaser configuration (.goreleaser.yaml) and a
release CI workflow so that pushing a version tag automatically:

• builds cross-platform binaries for cmd/vibe-check
  (linux/darwin/windows × amd64/arm64);
• embeds build metadata via
  -ldflags "-X main.version=... -X main.commit=... -X main.date=...";
• publishes a GitHub Release with generated notes and a checksums.txt.

Why It Matters

v0.1.0 was tagged and released manually. Two gaps result:

1. No pre-built artifacts. There is no .goreleaser.yaml and no GitHub
   Release, so users must install with a Go toolchain
   (go install .../cmd/vibe-check@v0.1.0) rather than downloading a binary.
2. --version is not fully populated on installed binaries. For
   module-cache installs, versionString() in cmd/vibe-check/root.go falls
   back to runtime/debug.ReadBuildInfo(), which yields the module version but
   leaves commit/date as none/unknown. ldflags embedding via GoReleaser
   makes all three meaningful for released binaries.

Acceptance Criteria

• .goreleaser.yaml builds cmd/vibe-check across the platform matrix.
• ldflags populate main.version, main.commit, and main.date.
• Release workflow triggers on tag push (v*), uses SHA-pinned actions, and
  sets least-privilege permissions (contents: write only for the release job).
• Release includes a checksums file.
• vibe-check --version on a released binary reports real version/commit/date.

References

• Deferred follow-up recorded in openspec/changes/go-analyze/proposal.md.
• Surfaced by /uf.review-council (SRE + Herald personas) during review of PR feat: add Go adapter and vibe-check analyze CLI command #21.
• Version fallback: cmd/vibe-check/root.go (versionString()).
• Relates to Epic Epic: Vibe-Check — Design Quality & Architectural Metrics Toolkit #20.

Note: this issue should be labeled build (or ci) once that label exists.