feat(release): darwin/arm64 release workflow #148

Job	Run time
Trivy (filesystem + container scan)	14s
OSV-Scanner (SCA)	5s
SBOM (SPDX + CycloneDX)	19s
jscpd (duplication < 3% on touched code)	15s
Gitleaks (secret scan)	13s
Semgrep (SAST)	31s
	1m 37s

Provide feedback