feat(ci): add semantic-release pipeline, cross-platform builds, and lefthook git hooks

- Replace single wails.yml with three-workflow pipeline: ci.yml (PR checks),
  release.yml (semantic-release on main), build.yml (versioned builds on tag)
- PR pipeline: conventional commit lint, golangci-lint, govulncheck, go test,
  codegen freshness check, frontend type-check, cross-platform build verification
- Release pipeline: semantic-release with auto-changelog and draft GitHub releases
- Build pipeline: versioned linux/amd64, darwin/universal, windows/amd64 binaries
  with version and commit SHA injected via ldflags
- Add lefthook as go tool for pre-commit (vet, lint, codegen, tsc) and
  pre-push (test, mod verify) git hooks
- Fix golangci-lint gci config to enforce three-group import style
- Upgrade Go to 1.25
- Add version/commit variables to main.go for build-time injection
- Add lint, test, vulncheck, and setup targets to Makefile

Makefile

@@ -1,18 +1,34 @@
+VERSION ?= dev
+COMMIT  ?= $(shell git rev-parse --short HEAD 2>/dev/null || echo "unknown")
+LDFLAGS := -X 'main.version=$(VERSION)' -X 'main.commit=$(COMMIT)'
+
 dev: generate clean
 	WEBKIT_DISABLE_DMABUF_RENDERER=1 wails dev -tags webkit2_41 -loglevel Debug -v 2
 
 build-dev: generate
-	wails build -tags webkit2_41 -debug -clean
+	wails build -tags webkit2_41 -debug -clean -ldflags "$(LDFLAGS)"
 
 build-prod: generate
-	wails build -tags webkit2_41 -clean -obfuscated -upx
+	wails build -tags webkit2_41 -clean -obfuscated -upx -ldflags "-s -w $(LDFLAGS)"
 
 build-frontend:
-	cd frontend && pnpm build
+	cd frontend && pnpm install && pnpm build
 
-clean: 
+clean:
 	rm -rf frontend/dist
 	rm -rf frontend/node_modules
 
 generate:
 	go generate ./...
+
+lint:
+	golangci-lint run
+
+test:
+	go test -tags webkit2_41 -race -count=1 -timeout 120s ./...
+
+vulncheck:
+	go run golang.org/x/vuln/cmd/govulncheck@latest ./...
+
+setup: ## Install git hooks (lefthook is managed via go.mod tool directive)
+	go tool lefthook install