ci: add goreleaser-driven release pipeline

.github/workflows/release.yml

@@ -0,0 +1,32 @@
+name: release
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+
+permissions:
+  contents: write
+
+jobs:
+  goreleaser:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # goreleaser needs full history for version detection
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.26.2'
+          cache: true
+
+      - name: Run goreleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          version: '~> v2'
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.goreleaser.yaml

@@ -0,0 +1,66 @@
+version: 2
+
+project_name: veto
+
+before:
+  hooks:
+    - go mod download
+    # Regenerate internal/interposer/pm_names.h from the canonical Go PM
+    # list before building. Veto itself does not cgo-link the interposer
+    # (see internal/interposer/gen/gen.go), but Task 3's pending embed
+    # work will go:embed veto_interpose.c at install time. Keeping the
+    # header in sync at release time means the embedded source compiles
+    # cleanly on the user's host.
+    - go generate ./internal/interposer/gen/...
+
+builds:
+  - id: veto
+    main: ./cmd/veto
+    binary: veto
+    # CGO disabled: veto itself is pure Go. The C interposer is built
+    # standalone by the Makefile (and, post-Task 3, by `veto
+    # install-preload` against an embedded copy of veto_interpose.c).
+    # Disabling CGO lets a single linux runner cross-compile darwin
+    # binaries without a darwin runner or osxcross toolchain.
+    env:
+      - CGO_ENABLED=0
+    flags:
+      - -trimpath
+    # The -X targets are not yet defined in main.go on origin/main
+    # (Task 5 lands them). Go's linker silently ignores -X against
+    # undefined symbols, so these are no-ops until Task 5 merges and
+    # become meaningful automatically afterward.
+    ldflags:
+      - -s -w
+      - -X main.version={{ .Version }}
+      - -X main.commit={{ .ShortCommit }}
+      - -X main.buildDate={{ .Date }}
+    goos:
+      - linux
+      - darwin
+    goarch:
+      - amd64
+      - arm64
+
+archives:
+  - id: default
+    name_template: >-
+      veto_{{ .Version }}_{{ .Os }}_{{ .Arch }}
+    # No LICENSE file exists on origin/main HEAD; only ship README.md
+    # alongside the binary. If the maintainer later adds LICENSE, append
+    # it here.
+    files:
+      - README.md
+    formats:
+      - tar.gz
+
+checksum:
+  name_template: checksums.txt
+  algorithm: sha256
+
+snapshot:
+  version_template: "{{ incpatch .Version }}-snapshot"
+
+release:
+  prerelease: auto
+  draft: false

README.md

@@ -8,13 +8,22 @@ surfaces before they can launch package-manager code.
 
 ## Quickstart
 
+Install the latest release binary, then run `install-all`:
+
 ```sh
-git clone https://github.com/brynbellomy/veto.git
-cd veto
-make install
+TAG=$(curl -fsSL https://api.github.com/repos/brynbellomy/veto/releases/latest | jq -r .tag_name)
+OS=$(uname -s | tr A-Z a-z)                                      # linux | darwin
+ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')        # amd64 | arm64
+curl -fsSL "https://github.com/brynbellomy/veto/releases/download/${TAG}/veto_${TAG#v}_${OS}_${ARCH}.tar.gz" \
+  | tar -xz -C /tmp veto
+install -m 0755 /tmp/veto "$HOME/.local/bin/veto"
 veto install-all --force
 ```
 
+Verify the tarball against `checksums.txt` on the same release page
+before installing. To build from source instead, see [Installation
+Details](#installation-details) below.
+
 `install-all` installs the shims, managed shell block, Claude hook,
 native interposer, real-binary wrappers, intel cache, and doctor checks.
 Open a new terminal or source your shell rc file, then verify the setup:
@@ -69,6 +78,23 @@ version of the name refuses, since the caller hasn't pinned.
 
 ## Installation Details
 
+### From a release (recommended)
+
+The [Quickstart](#quickstart) snippet pulls the latest tagged release
+tarball for your `(OS, arch)` from
+`https://github.com/brynbellomy/veto/releases` and drops the `veto`
+binary into `~/.local/bin/`. Each release ships `linux_amd64`,
+`linux_arm64`, `darwin_amd64`, and `darwin_arm64` tarballs alongside
+a `checksums.txt` with SHA256 sums.
+
+### From source
+
+```sh
+git clone https://github.com/brynbellomy/veto.git
+cd veto
+make install   # runs `go test -race ./...` then installs to ~/.local/bin/veto
+```
+
 `make install` builds `veto` into `~/.local/bin/veto`. `install-all`
 builds `libveto_interpose.dylib`/`.so` with `make interposer` when
 needed. Open a new terminal, or source your shell rc file, for the