Add automated semver + CI + binary release workflows

[dolph]

Summary

Sets up automated semver + CI + binary release for this repo:

• ci.yml runs go vet, go build, and go test -race on every PR and on every push to main.
• release.yml chains off a successful CI run on main: it reads the merged PR's release:* label, computes the next semver tag, builds a static linux/amd64 binary (find-replace-linux-amd64), pushes the tag, and publishes a GitHub release with auto-generated notes.

go.yml is removed; its tag-triggered build/release flow is replaced by the PR-label-driven release.yml. codeql-analysis.yml and golangci-lint.yml are left alone.

Version-bump labels

Apply exactly one to a PR (default is release:patch if none set):

Label	Bump	When to use
release:major	1.4.7 → 2.0.0	Breaking change
release:minor	1.4.7 → 1.5.0	Backwards-compatible new behavior
release:patch	1.4.7 → 1.4.8	Bug fix, refactor, dep bump (default)
release:skip	—	Docs-only / CI-only, no release

Precedence: skip > major > minor > patch. Direct pushes to main (no PR) fall back to release:patch.

Behavior changes vs. the old go.yml

• Trigger. Releases used to fire on git push origin vX.Y.Z; they now fire automatically after a PR merge to main, based on the merge commit's PR label. The next tag is computed from the latest existing tag, so the first merge after this PR cuts a patch bump by default.
• Asset name. The old workflow published find-replace (no arch suffix); the new workflow publishes find-replace-linux-amd64. Anything pulling the latest release asset will need its URL updated.
• Release notes. Previously used README.md as the release body; now auto-generated from PR titles + commit messages since the previous tag (via gh release create --generate-notes --notes-start-tag).
• Build path. CI runs go vet / go build ./... / go test -race ./... directly instead of invoking ./build.sh.

Test plan

• After merge, the CI workflow runs on this PR and passes.
• After merge, the release workflow fires on the post-merge push to main and cuts the next patch tag with find-replace-linux-amd64 attached.
• A subsequent PR with release:minor cuts a minor bump.
• A subsequent PR with release:skip produces no new tag.