feat: add release pipeline — GoReleaser + GitHub Actions + Homebrew Tap

[LastStep]

Summary

Add automated release pipeline using GoReleaser, GitHub Actions, and Homebrew Tap. Push a semver tag (e.g., v0.1.0) to trigger cross-platform binary builds published to GitHub Releases, with automatic Homebrew formula updates.

Changes

• cmd/root.go — add Version variable and SetVersion function for --version flag
• main.go — add version ldflags variable, wire to cmd.SetVersion
• Makefile — add ldflags for version injection in build/install targets
• .goreleaser.yaml — GoReleaser v2 config (6 platform targets, checksums, changelog, Homebrew formula)
• .github/workflows/release.yml — GitHub Actions workflow triggered on semver tags
• .gitignore — add dist/ (GoReleaser output)

Plan

station/Playbook/Plans/Active/04-release-pipeline.md

Verification

• make build — passes
• ./bonsai --version — prints "bonsai version dev"
• go test ./... — passes

🤖 Generated with Claude Code

[LastStep]

Tech Lead Review: Pass ✓

Verdict: Ready to merge — clean implementation, all checks pass.

Findings:

• Correctness: version injection chain verified end-to-end (ldflags → main.version → cmd.SetVersion → rootCmd.Version → --version output)
• Security: no secrets hardcoded, minimal permissions (contents: write), tokens from repository secrets only
• Scope: 6 files changed, all within plan scope, no extras
• Standards: follows project conventions

Audit:

• make build — pass
• go test ./... — pass
• ./bonsai --version — prints bonsai version dev
• Diff review — matches plan exactly

Observations (non-blocking):

• Exported cmd.Version var is initialized but only written to — harmless, serves as readable reference
• GitHub Actions pinned to major versions (@v4, @v5, @v6) rather than SHA hashes — standard practice

Setup required before first release:

1. Create LastStep/homebrew-tap repo on GitHub
2. Create a GitHub PAT with repo scope
3. Add it as HOMEBREW_TAP_TOKEN secret on LastStep/Bonsai
4. Tag and push: git tag v0.1.0 && git push origin v0.1.0

Plan: station/Playbook/Plans/Active/04-release-pipeline.md