refactor(actions): replace CLI artifact with cached builds

[jmgilman]

Summary

• build release-cli from the exact reusable-workflow source for this repository's matching version tag
• restore source-SHA-scoped GOCACHE and GOMODCACHE entries in each sequential release job
• remove the dedicated CLI build job, same-run CLI artifact, and workflow-level cli-path escape hatches
• retain verified release installation for consumer repositories and force it in the installed-path check
• update release workflow, action, trust-boundary, how-to, and reference contracts

Acquisition contract

setup-release-cli now selects among three paths:

1. Source build: the release repository's matching version tag, or explicit local-build: always. The action and reusable workflow must come from the same repository, and the runner must provide an exact workflow SHA.
2. Installed release: consumer repositories, or explicit local-build: never. The existing checksum and GitHub attestation verification remains unchanged.
3. Caller path: direct action callers may still supply the unsupported cli-path escape hatch and own that pairing.

The executable is never cached. A cache miss performs a complete build, and every supported path must report the action's stamped version and protocol.

Evidence

A clean-cache four-job GitHub spike proved the production sequence before cutover: run 32335377611.

• Go cache: first=false second=true third=true fourth=true
• independently linked binaries: identical SHA-256 7e59af4c3db67b2524fb257c0d568fe84fc06738d68158e36bb04dd9777d3d61
• job durations: 31 seconds cold; 13, 7, and 9 seconds warm
• clean toolchain cache installed only pinned Go 1.26.6

Verification

• mise exec -- moon run root:check
• GitHub CI: run 32383263681
• Kusari Inspector
• GitNexus staged change scope: low risk; no affected execution processes

Trust-boundary change

The release no longer transports one low-privilege-built CLI artifact. Each publishing job installs Go and executes the exact pinned workflow source instead. The source SHA and strict version/protocol check establish CLI identity; GitHub caches are an optimization only.

[jmgilman]

Clean-cache result: the cached local-build design works.

• Run: https://github.com/meigma/release/actions/runs/32335377611
• Go cache: first=false, second=true, third=true, fourth=true
• Binary identity: all four independent builds produced SHA-256 7e59af4c3db67b2524fb257c0d568fe84fc06738d68158e36bb04dd9777d3d61
• Job durations: 31s cold; 13s, 7s, and 9s warm
• Toolchain: clean mise cache installed only pinned Go 1.26.6; implicit mise exec installation is disabled
• Validation: version 0.1.0 and protocol 1 matched in every job; CI, actionlint, protocol check, and Kusari passed

Conclusion: exact-key GOCACHE/GOMODCACHE reuse removes repeated compilation cost. The remaining decision is policy, not feasibility: replacing the current build-once artifact would install a compiler and execute source in each publishing job. This PR intentionally does not migrate production workflows.