feat(cli): stage Go release artifacts

[jmgilman]

Summary

First slice of the release-cli program (architecture rev 3, plan §3 PR 1). Four production packages replace the producer's bespoke bash validation, and this repository's released artifact becomes release-cli instead of the release-mvp exercise binary.

• release-cli stage --profile go --dist PATH [--json] replaces the two validation steps formerly at go-pre-publish.yml:88-119 (inventory PP-06/PP-07/PP-08), about 32 lines of bash.
• release-cli version [--json] reports the linker-injected version and commit plus the protocol constant.
• .github/actions/setup-release-cli acquires the CLI from the stamped release or from a caller-supplied cli-path.
• scripts/check-protocol-stamp.sh keeps the action's EXPECTED_PROTOCOL, the Go cli.Protocol constant, and the Release Please stamping markers in step; wired into moon run root:check.

Behavior preserved

PP-06 verifies every checksums.txt payload hash and requires a non-empty regular checksums.txt.sigstore.json. PP-07 requires exactly one Linux Binary record per amd64 and arm64. PP-08 requires each selected path to be confined under the dist root, a regular file, and executable.

Path confinement uses os.OpenRoot, so a symlink escaping the dist root is rejected — not only a lexical ... The workflow_call contract and the PP-09/PP-10 upload steps are unchanged.

Contract

• Exit codes 0 success, 1 contract/verification failure, 2 usage or configuration error. No exit 3, no generic safe-rerun promise.
• Under --json, stdout carries exactly one release.dev/result/v1 envelope, including failures with ok:false. If flag parsing itself fails there is deliberately no envelope: usage goes to stderr with exit 2.
• version prints its data to stdout; stage prints nothing to stdout on success without --json.
• One release unit: workflows, composite action, and CLI share one version and one consumer pin. There is deliberately no cli-version input. cli-path is an unsupported escape hatch that warns rather than fails on stamp mismatch; the installed path fails closed.
• go-pre-publish.yml loads the composite through uses: $/.github/actions/setup-release-cli, because external consumers run that workflow against their own checkout.

Verification

• mise exec -- moon run root:check green: format, lint (strict .golangci.yml), build, test, protocol stamp.
• Direct binary exercise, not only tests: version and version --json; bare invocation and unknown flag both exit 2 with empty stdout; unknown profile exits 2; env-only resolution through RELEASE_PROFILE, RELEASE_DIST, RELEASE_JSON; flag-over-env precedence; a valid bundle under a non-dist directory name exits 0.
• Six mutations each exit 1 with ok:false: bad checksum, missing architecture record, escaped path, cleared execute bit, symlink escaping the dist root, and missing signature bundle.
• Marker guard proven by deleting a Release Please marker and observing exit 1.
• Three architecture spikes passed beforehand and gate this design: self-repository ($/) pin immunity under an external SHA-pinned caller, oras-go v2.6.2 GHCR parity, and Release Please stamping plus the protocol guard.

Review

Two review rounds by a dedicated reviewer (verdict: go) and one AGENTS.md conformance audit.

Fixed from those rounds:

• Fail closed when github.action_repository is empty. It previously fell back to the consumer's repository, which collapsed the download source and the attestation trust root onto untrusted ground.
• Sentinel-based exit classification. A data-controlled asset name could previously flip a verification failure to exit 2.
• Path confinement derived from the supplied dist directory rather than a hardcoded prefix.
• --signer-workflow and --deny-self-hosted-runners added to the bootstrap attestation check, matching what the docs tell consumers to run.
• A bare invocation no longer exits 0 with help on stdout.
• Standard-library usage per R3, nil guards at exported boundaries, and Viper removed under L1.

Follow-ups recorded in the journal, not in this PR

• The installed acquisition path cannot be exercised until this PR's first release exists; a dispatchable smoke job lands with PR 2.
• cmd/release-cli/main.go has no CLI-level testscript coverage; testscript is deferred by the plan.
• A nested or absolute dist value still fails closed with exit 1 and is documented as the basename rule.

Human acceptance requested. I have not merged.