feat(ci): add semantic-release pipeline, cross-platform builds, and lefthook git hooks

- Replace single wails.yml with three-workflow pipeline: ci.yml (PR checks),
  release.yml (semantic-release on main), build.yml (versioned builds on tag)
- PR pipeline: conventional commit lint, golangci-lint, govulncheck, go test,
  codegen freshness check, frontend type-check, cross-platform build verification
- Release pipeline: semantic-release with auto-changelog and draft GitHub releases
- Build pipeline: versioned linux/amd64, darwin/universal, windows/amd64 binaries
  with version and commit SHA injected via ldflags
- Add lefthook as go tool for pre-commit (vet, lint, codegen, tsc) and
  pre-push (test, mod verify) git hooks
- Fix golangci-lint gci config to enforce three-group import style
- Upgrade Go to 1.25
- Add version/commit variables to main.go for build-time injection
- Add lint, test, vulncheck, and setup targets to Makefile

.github/workflows/release.yml

@@ -0,0 +1,45 @@
+name: Release
+run-name: Release — determine version
+
+on:
+  push:
+    branches: [main]
+
+# Only one release at a time.
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  semantic-release:
+    name: Semantic Release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install semantic-release and plugins
+        run: >
+          npm install --no-save
+          semantic-release@24
+          @semantic-release/changelog@6
+          @semantic-release/git@10
+          @semantic-release/github@11
+          @semantic-release/commit-analyzer@13
+          @semantic-release/release-notes-generator@14
+          conventional-changelog-conventionalcommits@8
+
+      - name: Run semantic-release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: npx semantic-release