feat(ci): add semantic-release pipeline, cross-platform builds, and lefthook git hooks

- Replace single wails.yml with three-workflow pipeline: ci.yml (PR checks),
  release.yml (semantic-release on main), build.yml (versioned builds on tag)
- PR pipeline: conventional commit lint, golangci-lint, govulncheck, go test,
  codegen freshness check, frontend type-check, cross-platform build verification
- Release pipeline: semantic-release with auto-changelog and draft GitHub releases
- Build pipeline: versioned linux/amd64, darwin/universal, windows/amd64 binaries
  with version and commit SHA injected via ldflags
- Add lefthook as go tool for pre-commit (vet, lint, codegen, tsc) and
  pre-push (test, mod verify) git hooks
- Fix golangci-lint gci config to enforce three-group import style
- Upgrade Go to 1.25
- Add version/commit variables to main.go for build-time injection
- Add lint, test, vulncheck, and setup targets to Makefile

lefthook.yml

@@ -0,0 +1,39 @@
+# lefthook.yml — local git hooks for yellowjacket
+# Install with: lefthook install
+# Docs: https://github.com/evilmartians/lefthook
+
+pre-commit:
+  parallel: true
+  commands:
+    go-vet:
+      glob: "*.go"
+      run: go vet -tags webkit2_41 ./...
+
+    golangci-lint:
+      glob: "*.go"
+      run: golangci-lint run --timeout 5m -tags webkit2_41 {staged_files}
+
+    codegen-check:
+      glob: "*.{go,sql,templ}"
+      run: |
+        go generate ./...
+        if [ -n "$(git diff --name-only)" ]; then
+          echo "Generated code is out of date. Run 'make generate' and stage the changes."
+          git diff --stat
+          exit 1
+        fi
+
+    frontend-typecheck:
+      glob: "frontend/**/*.{ts,tsx}"
+      root: "frontend/"
+      run: pnpm exec tsc --noEmit
+
+pre-push:
+  parallel: true
+  commands:
+    go-test:
+      glob: "*.go"
+      run: go test -tags webkit2_41 -race -count=1 -timeout 120s ./...
+
+    go-mod-verify:
+      run: go mod verify