ci: publish standalone Linux binaries with GitHub releases

[ilbertt]

Publish Linux amd64 and arm64 archives, including the license and SHA-256 checksums, with future tagged releases. This reuses the existing Docker build and adds standalone setup instructions, including the difference in Litestream backup behavior.

Following up on #108: I created nibrun to make open-source apps that ship as a single binary easy to deploy. Official release assets will let me finish Calnode’s one-click preset and app page, then propose a “Deploy on nibrun” button like PicoShare’s.

Validated with go test ./..., make build, and actionlint. Built and packaged both architectures, verified checksums, and ran each extracted binary under a 256 MB limit: health/readiness, database migrations, version metadata, embedded admin UI assets, and restart all passed.

[pullfrog]

Run failed. View the logs →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using opencode-go/deepseek-v4.1-flash ｜ 𝕏}

[github-actions]

All contributors have signed the CLA. ✅
_{Posted by the CLA Assistant Lite bot.}

[ilbertt]

I have read the CLA Document and I hereby sign the CLA

[shockalotti]

Reviewed the diff — build correctness checks out (pure-Go sqlite, CGO_ENABLED=0 already in the builder, tzdata embedded, scratch-stage layout matches the tar paths, checksums attached, release gating correct, Dockerfile default target unaffected, docs accurate including the Litestream caveat).

Not merging yet for one reason: this is still a draft, and the entire new chain (export/package/upload/download/release) has never executed green anywhere — the fork workflow runs sit at action_required. Before merge: approve the fork workflows to run (or push to a non-fork branch) so Docker publish goes green on the PR, and dry-run the release job's download + create step somehow, since that line can never run on a PR by construction.

Optional efficiency nit: gate the export/package/upload steps to tags so every PR/main/dev build doesn't pay multi-arch packaging cost for artifacts only releases consume.