ci: automate release artifact builds via GitHub Actions

[DTTerastar]

Summary

• Adds .github/workflows/release.yml, which builds and uploads the six platform archives plus a SHA256SUMS.txt on every v* tag push.
• Archive names and the binary inside each zip match the v2.0.2 release exactly, so existing install scripts / download URLs are preserved.
• Uses macos-latest because lipo is required for splunk-cli-darwin-universal; Go cross-compiles the other platforms from the same runner.

Motivation

The release process documented in BUILD.md is fully manual: tag, push, run make build-all locally, zip each binary, and upload via the web UI. That step was missed for v2.0.3 — the release ships with zero artifacts, so anyone trying to pick up the Windows/NTFS permission-check fix has to build from source.

Automating it removes the foot-gun and means future releases can't accidentally ship empty.

Recovering v2.0.3

Once this is merged, the simplest way to repair v2.0.3 is to delete and re-push the tag:

git push origin :refs/tags/v2.0.3
git tag -d v2.0.3
git tag v2.0.3 <commit-sha>
git push origin v2.0.3

That triggers the workflow and attaches the six archives to the existing release.

Test plan

• Merge to main, then push a throwaway tag (e.g. v2.0.3-rc1) to confirm the workflow attaches all six archives + SHA256SUMS.txt.
• Unzip one archive and confirm the inner binary name matches the v2.0.2 layout (splunk-cli-<os>-<arch>, or splunk-cli-windows-amd64.exe).
• Re-tag v2.0.3 to restore its artifacts.

🤖 Generated with Claude Code