Automate releases with GoReleaser

[notque]

Summary

• add a tag-triggered GoReleaser workflow for vX.Y.Z releases
• configure GoReleaser to publish the existing raw binary asset names: hermescli, hermescli.exe, and hermescli_darwin
• embed client.Version through ldflags so hermescli version reports the release tag

Validation

• go run github.com/goreleaser/goreleaser/v2@latest check
• go run github.com/goreleaser/goreleaser/v2@latest release --snapshot --clean --skip=publish
• snapshot artifact names: hermescli, hermescli.exe, hermescli_darwin
• snapshot Darwin binary: hermescli v0.5.9-next compiled with go1.26.2 on darwin/amd64
• go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/release.yaml
• make build/cover.out
• git diff --check

Note: reuse lint only fails because of unrelated untracked .claude/ files in the local worktree.