ci: release with release-please

[nozaq]

Summary

Replace tag-triggered releases with release-please.

• release.yml runs on pushes to main. release-please keeps a release PR open; merging it creates a draft release (with force-tag-creation, so the tag exists immediately). The existing build / checksums / cosign / attest / GHCR jobs then run, and the release job uploads the assets and publishes the draft. Immutable releases reject uploads after publication, so the assets must be attached while the release is still a draft.
• release-please authenticates as a GitHub App (actions/create-github-app-token), because a release PR opened with GITHUB_TOKEN does not trigger CI. Its credentials come from the release environment, which only push runs enter.
• The GHCR semver tags now take the version from release-please's tag_name (value=), since the run is no longer triggered by a tag push.
• Renovate switches from :semanticCommitTypeAll(chore) to :semanticPrefixFixDepsChoreOthers, so dependency updates that ship in the binary or image use fix(deps) and cut a patch release. cmd/dockerflagsgen dependencies stay chore, and Go toolchain updates (go directive, golang image) become fix.
• CONTRIBUTING documents how PR types map to releases and the App setup.

Before merging

• googleapis/release-please-action must be in the repository's allowed actions.
• The release environment holds the App's RELEASE_PLEASE_CLIENT_ID (variable) and RELEASE_PLEASE_PRIVATE_KEY (secret). The App needs Contents, Issues and Pull requests read & write.
• Keep the Release-As: 0.8.1 footer in the squash commit message, so the first release PR is for 0.8.1 (the commits since v0.8.0 are all chore/ci and would not cut a release otherwise).

Testing

• actionlint on release.yml: no findings apart from ubuntu-slim and cache-mode, which that actionlint version does not know yet.
• renovate-config-validator: config validated successfully.
• The pull request run of release.yml exercises the build and docker jobs without publishing.

🤖 Generated with Claude Code