feat(ci): add semantic-release pipeline, cross-platform builds, and lefthook git hooks

- Replace single wails.yml with three-workflow pipeline: ci.yml (PR checks),
  release.yml (semantic-release on main), build.yml (versioned builds on tag)
- PR pipeline: conventional commit lint, golangci-lint, govulncheck, go test,
  codegen freshness check, frontend type-check, cross-platform build verification
- Release pipeline: semantic-release with auto-changelog and draft GitHub releases
- Build pipeline: versioned linux/amd64, darwin/universal, windows/amd64 binaries
  with version and commit SHA injected via ldflags
- Add lefthook as go tool for pre-commit (vet, lint, codegen, tsc) and
  pre-push (test, mod verify) git hooks
- Fix golangci-lint gci config to enforce three-group import style
- Upgrade Go to 1.25
- Add version/commit variables to main.go for build-time injection
- Add lint, test, vulncheck, and setup targets to Makefile

.releaserc.yml

@@ -0,0 +1,81 @@
+# semantic-release configuration
+# Runs on main branch pushes to auto-determine version from conventional commits.
+# Creates a git tag + GitHub Release draft; a separate workflow builds binaries.
+branches:
+  - main
+
+plugins:
+  # Analyze commits using conventional-commits preset.
+  - - "@semantic-release/commit-analyzer"
+    - preset: conventionalcommits
+      releaseRules:
+        - type: feat
+          release: minor
+        - type: fix
+          release: patch
+        - type: perf
+          release: patch
+        - type: refactor
+          release: patch
+        - type: revert
+          release: patch
+        - type: docs
+          release: false
+        - type: style
+          release: false
+        - type: chore
+          release: false
+        - type: ci
+          release: false
+        - type: test
+          release: false
+        - type: build
+          release: false
+
+  # Generate release notes from conventional commits.
+  - - "@semantic-release/release-notes-generator"
+    - preset: conventionalcommits
+      presetConfig:
+        types:
+          - type: feat
+            section: Features
+          - type: fix
+            section: Bug Fixes
+          - type: perf
+            section: Performance
+          - type: refactor
+            section: Refactoring
+          - type: revert
+            section: Reverts
+          - type: docs
+            section: Documentation
+            hidden: true
+          - type: chore
+            section: Miscellaneous
+            hidden: true
+          - type: ci
+            section: CI/CD
+            hidden: true
+          - type: test
+            section: Tests
+            hidden: true
+          - type: build
+            section: Build
+            hidden: true
+
+  # Write CHANGELOG.md.
+  - - "@semantic-release/changelog"
+    - changelogFile: CHANGELOG.md
+
+  # Commit the changelog back to the repo.
+  - - "@semantic-release/git"
+    - assets:
+        - CHANGELOG.md
+      message: "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
+
+  # Create the GitHub Release (draft, so the build workflow can attach binaries).
+  - - "@semantic-release/github"
+    - draft: true
+      successComment: false
+      failComment: false
+      releasedLabels: false