ci: publish prebuilt CLI binaries

[melonamin]

Summary

• Build prebuilt flowscope CLI archives for Linux x86_64/aarch64, macOS Intel/Apple Silicon, and Windows x86_64 on future release tags.
• Publish per-archive SHA-256 checksums, an aggregate SHA256SUMS manifest, and GitHub build provenance attestations.
• Guard package publishing on forks, pin the binary build actions, smoke-test every target, and document installation and verification.

This is the focused binary-distribution portion of #66, based on current master (v0.9.1). It preserves Dimitri Vasdekis's three release commits and Alex Mabe's portability fix with their original authorship. The remaining fork head changes in #66 are outside issue #65. The existing v0.9.1 release and assets are unchanged.

Validation

• actionlint .github/workflows/publish-core.yml and just check passed locally.
• PR CI passed.
• Release workflow dry run passed, including five native build jobs, five --version smoke tests, and package publish dry-run checks.
• Downloaded all five CI archives. Each .sha256 passed; archive contents and executable formats matched their targets. A five-entry aggregate manifest passed sha256sum -c.
• Reviewed tag gating, artifact names, permissions, and pinned action contracts. Release creation and attestations run only on a future tag, so they were not exercised against v0.9.1.

Closes #65

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!