feat(release): Phase 5 — Goreleaser + Sigstore + perf gate #132

Job	Run time
SBOM (SPDX + CycloneDX)	19s
Gitleaks (secret scan)	11s
jscpd (duplication < 3% on touched code)	15s
Semgrep (SAST)	34s
OSV-Scanner (SCA)	5s
Trivy (filesystem + container scan)	18s
	1m 42s

Provide feedback