chore: settle whether runnable-go is consumed from source or published, and close the release-path gap #12

Carved out of umbrella #1, whose last non-delegated line is "Compatible distribution/release and retained Markdown milestone". Surfaced by #11 during the Core v0.3.41 bump; #11 stays a clean go.mod/go.sum bump and defers this here rather than hand-tagging around it.

The question to settle first

Is this repository consumed from source / by module path, or resolved as a published artifact like the other agents? The release workflow is only the answer to one branch, so decide this before building anything.

• Consumed from source — merging to main is genuinely enough, and agent.codefly.yaml's version field is not a published identity. Then say so explicitly, because the field currently implies otherwise.
• Resolved as a published artifact — this repo is missing the release workflow the rest of the fleet has, and a merge to main advertises nothing to a consumer.

Evidence

Verified on main at 3109d18:

• git tag -l is empty, and git ls-remote --tags origin returns nothing. There has never been a release here, local or remote.
• .github/workflows/ contains exactly one file, ci.yml (build/vet/test). There is no releaser.yml.
• agent.codefly.yaml declares publisher: codefly.dev, kind: codefly:runnable, name: go, version: 0.0.1 — a version field with nothing that publishes it.
• runnable-python, the sibling agent, has v0.0.2 and a releaser.yml. This repo is the outlier.

Why this is load-bearing, not cosmetic

Per the core#598 rollout, an agent does not write its own contract declaration — core's agent server fills it in (containerRecoveryInterceptor sets AgentInformation.Contract = contract.Current() when the handler leaves it nil, wired at agents/agents.go:446), and the agents/contract package first shipped in v0.3.39.

The declaration therefore rides in the compiled binary, so it reaches a consumer only through a published build. If this repo is ever resolved as a published artifact, merging the Core bump to main advertises nothing — which is the exact failure mode that rejected the 17 service artifacts in that rollout.

Fold in if a releaser lands

agent.codefly.yaml's version and the git tag must match exactly (0.0.1 ↔ v0.0.1), and nothing in any repo checks that coupling today; the capability is requested at codefly-dev/cli#758. A releaser.yml added here inherits that unchecked coupling from day one, so either wire the check or note it deliberately.

Done when

• The source-vs-published question is answered in writing, in this repo.
• If published: a releaser.yml consistent with the rest of the fleet, and a first tag whose version matches the manifest.
• If source-only: agent.codefly.yaml's version semantics documented so the next rollout does not re-raise this.

Evidence gathered jointly with the #11 session; independently re-verified here.