ci: helm lint, docker build, and release workflow

[kacy]

summary

• adds helm lint job to CI — runs helm lint and helm template on every push/PR to catch chart regressions
• adds docker build job to CI — builds the Dockerfile on every push/PR without pushing, validates it stays working
• adds a release workflow triggered on v* tags that:
  • builds binaries for linux amd64/arm64 and macos amd64/arm64
  • builds and pushes a docker image to ghcr.io
  • creates a github release with all binaries and a checksums file

what was tested

• reviewed rendered YAML for correctness
• CI workflow validates with existing job structure (all jobs run in parallel, no dependencies)
• release workflow uses needs: [build, docker] so the github release only runs after binaries and docker image are ready

design considerations

• release builds target 4 platforms: linux/mac x amd64/arm64. arm64 linux uses cross-compilation via gcc-aarch64-linux-gnu
• docker image is pushed to ghcr.io (free, no secrets to configure beyond the default GITHUB_TOKEN)
• release notes are auto-generated from commits between tags
• kept the docker CI job simple — just docker build, no push. the release workflow handles pushing