Add release readiness and versioned distribution workflows

[jacklilyhello]

Motivation

• Provide Phase F release infrastructure to produce repeatable, versioned binaries and Docker images without changing runtime semantics or bundled data handling.
• Enable safe pull-request dry-runs in CI and tag-triggered publishing to GHCR/GitHub Releases while avoiding secrets, runtime downloads, or automatic NetEase syncs.

Description

• Add build-time version metadata and a --version flag wired into the server and API with ldflags variables (main.version, main.commit, main.date) and a concise runtime summary that reports RE2 and PCRE2 availability; defaults remain dev/unknown/unknown to keep local builds safe (cmd/server/main.go, Dockerfile changes to pass ldflags).
• Add Makefile release targets: build-all (cross-platform RE2/CGO-free builds), release-check (local verification), and snapshot (create compressed artifacts and deterministic SHA256SUMS under ignored dist/), and propagate ldflags during builds (Makefile).
• Add CI workflows: .github/workflows/release-dry-run.yml to run on pull_request and validate packaging without publishing, and .github/workflows/release.yml to run on tag v* and create a GitHub Release + upload artifacts and push GHCR images (default RE2 and optional PCRE2) using only GITHUB_TOKEN.
• Add documentation and minimal changelog/README links describing tag workflow, supported platforms, default RE2 behavior, optional PCRE2 Docker-first distribution, GHCR tag strategy, and the GPL/MIT NetEase data boundary (docs/release.md, README.md, CHANGELOG.md).

Testing

• Core Go checks and unit tests passed: gofmt/make fmt-check, go test ./..., go vet ./..., go build ./..., CGO_ENABLED=0 go build ./..., and make verify-bundled-netease, make smoke, and make e2e all succeeded in the local environment.
• Release packaging commands succeeded locally: make build-all VERSION=test COMMIT=$(git rev-parse --short=12 HEAD) DATE=1970-01-01T00:00:00Z, make release-check VERSION=test ... (which exercised --version and checksum verification), and make snapshot produced deterministic SHA256SUMS.
• PCRE2-tagged checks failed locally because the environment lacked the PCRE2 development package: Package 'libpcre2-8', required by 'virtual:world', not found (so go test -tags pcre2, go build -tags pcre2, and make build-pcre2 were not completed locally).
• Docker and network-limited checks were skipped or failed due to environment limits: docker is not installed (/bin/bash: line 1: docker: command not found) and govulncheck failed to fetch the vulnerability DB (Get "https://vuln.go.dev/index/modules.json.gz": Forbidden); CI workflows include dry-run coverage and tag-triggered publishing where these will run with available runners and secrets; no real tag, GitHub Release, or image push was performed during this work.

---

Codex Task