Prepare spoold for public alpha launch

[Rionlyu]

Outcome

This makes spoold technically ready for a focused public-alpha release as durable curl: a crash-safe local HTTP outbox with no database, broker, or cloud dependency.

The market recheck found adjacent store-and-forward proxies, hosted queues, self-hosted webhook platforms, and telemetry buffers, but no researched alternative with the same narrow combination of arbitrary HTTP, synchronization before acknowledgement, deterministic local replay, and zero runtime service dependencies. The repository now states that defensible boundary without claiming the underlying pattern is new.

Product and reliability

• add exclusive journal ownership and owner-only Unix socket control
• bound new admission at 1 GiB while preserving transitions for accepted work
• retain terminal history for seven days by default without ever pruning pending or in-flight work
• keep idempotency through replay/compaction and expire keys with retained history
• make persistence failures sticky and automatically repair them through a fully synchronized replacement
• preserve the durability boundary when compaction fails between rename and directory synchronization
• prevent one destination from occupying all workers, including equivalent default-port origins
• support arbitrary byte bodies as well as JSON without changing existing JSON fingerprints
• keep list responses bounded while returning the full request from the detail endpoint
• expose readiness, retention, capacity, pruning, and compaction health

Launch distribution

• add versioned Linux/macOS archives for amd64/arm64 containing spoold and spoolctl
• add a checksummed installer, keyless Cosign signatures, SBOMs, and GitHub provenance
• publish a non-root multi-architecture GHCR image from immutable tags
• pin every release/CI action and reject release tags that are not merged to main
• exercise snapshot archives, the installer, both container definitions, persistent-volume replay, and embedded versions in CI
• add issue forms, contribution guidance, a security boundary, and a public launch runbook

Verification

• make verify
• go test -race ./...
• process-level SIGKILL/restart recovery test, repeated under the race detector
• staticcheck ./...
• deadcode ./...
• duplicate-code scan: 0 clone groups
• GoReleaser v2.17 configuration check and full local snapshot build
• all five archives and checksums verified
• snapshot installed through scripts/install.sh; both embedded versions verified
• Actionlint and shell syntax checks
• all documentation links checked

The v0.1.0 tag is deliberately not part of this PR. The launch runbook requires green PR and post-merge CI before creating the immutable release tag.