feat(ci): add semantic-release pipeline, cross-platform builds, and lefthook git hooks

- Replace single wails.yml with three-workflow pipeline: ci.yml (PR checks),
  release.yml (semantic-release on main), build.yml (versioned builds on tag)
- PR pipeline: conventional commit lint, golangci-lint, govulncheck, go test,
  codegen freshness check, frontend type-check, cross-platform build verification
- Release pipeline: semantic-release with auto-changelog and draft GitHub releases
- Build pipeline: versioned linux/amd64, darwin/universal, windows/amd64 binaries
  with version and commit SHA injected via ldflags
- Add lefthook as go tool for pre-commit (vet, lint, codegen, tsc) and
  pre-push (test, mod verify) git hooks
- Fix golangci-lint gci config to enforce three-group import style
- Upgrade Go to 1.25
- Add version/commit variables to main.go for build-time injection
- Add lint, test, vulncheck, and setup targets to Makefile

.github/workflows/ci.yml

@@ -0,0 +1,200 @@
+name: CI
+run-name: CI — ${{ github.head_ref || github.ref_name }}
+
+on:
+  pull_request:
+    branches: [main]
+  # Allow running manually for debugging.
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+env:
+  GO_VERSION: "1.25"
+  PNPM_VERSION: "10"
+  NODE_OPTIONS: "--max-old-space-size=4096"
+
+jobs:
+  # ──────────────────────────────────────────────
+  # Enforce conventional commit format on PR title
+  # (squash-merge means PR title = release commit)
+  # ──────────────────────────────────────────────
+  commitlint:
+    name: Lint PR Title
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@v5
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          types: |
+            feat
+            fix
+            perf
+            refactor
+            revert
+            docs
+            style
+            chore
+            ci
+            test
+            build
+
+  # ──────────────────────────────────────────────
+  # Go: lint, vet, vulnerability check
+  # ──────────────────────────────────────────────
+  go-checks:
+    name: Go Checks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libasound2-dev libgtk-3-dev libwebkit2gtk-4.1-dev
+
+      - name: Go mod verify
+        run: go mod verify
+
+      - name: Go vet
+        run: go vet -tags webkit2_41 ./...
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v7
+        with:
+          version: v2
+          args: --timeout 5m -tags webkit2_41
+
+      - name: govulncheck
+        uses: golang/govulncheck-action@v1
+        with:
+          go-version-input: ${{ env.GO_VERSION }}
+          go-package: ./...
+
+  # ──────────────────────────────────────────────
+  # Go: run tests
+  # ──────────────────────────────────────────────
+  go-test:
+    name: Go Tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libasound2-dev libgtk-3-dev libwebkit2gtk-4.1-dev
+
+      - name: Run tests
+        run: go test -tags webkit2_41 -race -count=1 -timeout 120s ./...
+
+  # ──────────────────────────────────────────────
+  # Code generation: verify generated code is fresh
+  # ──────────────────────────────────────────────
+  codegen-check:
+    name: Code Generation Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libasound2-dev libgtk-3-dev libwebkit2gtk-4.1-dev
+
+      - name: Run code generation
+        run: go generate ./...
+
+      - name: Check for uncommitted changes
+        run: |
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "::error::Generated code is out of date. Run 'make generate' and commit the changes."
+            git diff --stat
+            git diff
+            exit 1
+          fi
+          echo "Generated code is up to date."
+
+  # ──────────────────────────────────────────────
+  # Frontend: type-check and build
+  # ──────────────────────────────────────────────
+  frontend:
+    name: Frontend Build
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: ${{ env.PNPM_VERSION }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: frontend/pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Type check
+        run: pnpm exec tsc --noEmit
+
+      - name: Build
+        run: pnpm build
+
+  # ──────────────────────────────────────────────
+  # Build verification: ensure it compiles on all
+  # target platforms (no artifacts uploaded)
+  # ──────────────────────────────────────────────
+  build-check:
+    name: Build Check (${{ matrix.platform }})
+    needs: [go-checks, go-test, codegen-check, frontend]
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux/amd64
+            os: ubuntu-latest
+            build-name: yellowjacket
+            apt-deps: libasound2-dev
+          - platform: darwin/universal
+            os: macos-latest
+            build-name: yellowjacket
+          - platform: windows/amd64
+            os: windows-latest
+            build-name: yellowjacket.exe
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Install system dependencies (Linux)
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y ${{ matrix.apt-deps }}
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: ${{ env.PNPM_VERSION }}
+
+      - name: Build with Wails
+        uses: dAppServer/wails-build-action@main
+        with:
+          build-name: ${{ matrix.build-name }}
+          build-platform: ${{ matrix.platform }}
+          go-version: ${{ env.GO_VERSION }}
+          package: false
+          app-working-directory: ${{ github.workspace }}