feat(ci): add semantic-release pipeline, cross-platform builds, and lefthook git hooks

- Replace single wails.yml with three-workflow pipeline: ci.yml (PR checks),
  release.yml (semantic-release on main), build.yml (versioned builds on tag)
- PR pipeline: conventional commit lint, golangci-lint, govulncheck, go test,
  codegen freshness check, frontend type-check, cross-platform build verification
- Release pipeline: semantic-release with auto-changelog and draft GitHub releases
- Build pipeline: versioned linux/amd64, darwin/universal, windows/amd64 binaries
  with version and commit SHA injected via ldflags
- Add lefthook as go tool for pre-commit (vet, lint, codegen, tsc) and
  pre-push (test, mod verify) git hooks
- Fix golangci-lint gci config to enforce three-group import style
- Upgrade Go to 1.25
- Add version/commit variables to main.go for build-time injection
- Add lint, test, vulncheck, and setup targets to Makefile

main.go

@@ -9,12 +9,19 @@ import (
 	"github.com/golang-cz/devslog"
 	"github.com/wailsapp/wails/v2"
 	"github.com/wailsapp/wails/v2/pkg/options"
+
 	"yellowjacket/backend"
 	"yellowjacket/backend/assets"
 	"yellowjacket/backend/logging"
 	"yellowjacket/internal/dev"
 )
 
+// version and commit are set at build time via ldflags.
+var (
+	version = "dev"
+	commit  = "unknown"
+)
+
 //go:embed all:frontend/dist
 var frontendDistAssets embed.FS
 
@@ -34,7 +41,7 @@ func main() {
 		},
 	}))
 	slog.SetDefault(sLogger)
-	sLogger.Info("starting yellowjacket")
+	sLogger.Info("starting yellowjacket", "version", version, "commit", commit)
 
 	// create asset handler
 	assetHandler, err := assets.NewAssetHandler(sLogger, frontendDistAssets)