- release job (contents: write, gh CLI) creates the release with generated notes and uploads both binaries + sha256, --clobber for re-runs
- on tag builds the ldflags version comes from the tag itself
- test job: go vet + go test on push/PR/tag
- build job: CGO_ENABLED=0 cross-build linux/amd64 + windows/amd64 with version injection, sha256 checksums, uploaded as artifacts
- fix Makefile -X ldflags path after module rename
- add .gitattributes (LF normalization), ignore CI build outputs