Add automated semver + CI + binary release workflows

[dolph]

Summary

Sets up automated semver + CI + binary release for this repo:

• ci.yml runs go vet, go build, go test -race, and shellcheck on every PR and on every push to main. The shellcheck job (which lints every tracked *.sh file) is preserved from the previous go.yml.
• release.yml chains off a successful CI run on main: it reads the merged PR's release:* label, computes the next semver tag, builds a static linux/amd64 binary stamped with version + commit metadata via -X on the existing variables in version.go, pushes the tag, and publishes a GitHub release with ussher, ussher.sha256, and auto-generated notes.

The release asset is named ussher (no -linux-amd64 suffix) so the existing install.sh — which curls https://github.com/dolph/ussher/releases/latest/download/ussher and verifies it against ussher.sha256 — keeps working unchanged.

go.yml is removed; its shellcheck job moved into ci.yml and its tag-triggered build/release flow is replaced by the PR-label-driven release.yml. codeql-analysis.yml is left alone.

Version-bump labels

Apply exactly one to a PR (default is release:patch if none set):

Label	Bump	When to use
release:major	1.4.7 → 2.0.0	Breaking change
release:minor	1.4.7 → 1.5.0	Backwards-compatible new behavior
release:patch	1.4.7 → 1.4.8	Bug fix, refactor, dep bump (default)
release:skip	—	Docs-only / CI-only, no release

Precedence: skip > major > minor > patch. Direct pushes to main (no PR) fall back to release:patch.

Behavior changes vs. the old go.yml

• Trigger. Releases used to fire on git push origin vX.Y.Z; they now fire automatically after a PR merge to main, based on the merge commit's PR label. The next tag is computed from the latest existing tag (currently v1.1.0), so the first merge after this PR cuts v1.1.1 by default.
• Release notes. Previously sourced from CHANGELOG.md; now auto-generated from PR titles + commit messages since the previous tag (via gh release create --generate-notes --notes-start-tag). The CHANGELOG.md is no longer wired to the release body — keep maintaining it as project history if you want, but it won't appear on the release page automatically.
• Build path. CI runs go vet / go build ./... / go test -race ./... directly instead of invoking ./build.sh. The release step still stamps the same seven version.go variables (GitTag, GitCommit, GoVersion, BuildTimestamp, BuildOS, BuildArch, BuildTainted) and runs ./ussher --version as a sanity check.

Test plan

• After merge, the CI workflow (shellcheck + build & test) runs on this PR and passes.
• After merge, the release workflow fires on the post-merge push to main and cuts v1.1.1 with both ussher and ussher.sha256 attached.
• curl -fLO https://github.com/dolph/ussher/releases/latest/download/ussher && curl -fLO https://github.com/dolph/ussher/releases/latest/download/ussher.sha256 && sha256sum -c ussher.sha256 continues to succeed against the new release.
• ./ussher --version on the released binary prints a real tag (e.g. Version: v1.1.1), short commit, Go version, build date, linux/amd64.
• A subsequent PR with release:minor cuts v1.2.0.
• A subsequent PR with release:skip produces no new tag.