[amannocci]

Summary

• Add Pre release and Release workflows modelled on techcode-io/terranova.
• Pre release opens a PR bumping the version.
• Release runs the reusable CI, tags v<version> and publishes a GitHub release with .deb/.rpm packages for amd64 and arm64. It then opens a post-release PR bumping to the next -dev version.
• ci.yml is now callable from Release (workflow_call) and builds and packages for amd64 and arm64.
• Packages are attested, and a new sanitize job installs each .deb/.rpm and smoke-tests fix-perms.
• The v* tag trigger is removed; tags are now created by the Release workflow.
• Release logic lives in xtask (release:pre, release, release:post), std-only, with unit tests. The version is read from the workspace Cargo.toml.
• nfpm.yaml is parameterised by ${ARCH}/${TARGET}. xtask renders ${TARGET} itself because nfpm does not expand env vars in contents.src.
• Shared setup steps: env-install (Rust toolchain and cache) and setup-github-bot (git identity for bot commits).

Prerequisites

• Enable Settings → Actions → General → Allow GitHub Actions to create and approve pull requests.
• ubuntu-24.04-arm runners are only free for public repositories.

Test plan

• cargo fmt, cargo clippy -D warnings, cargo test --all pass locally.
• cargo xtask build produced deb and rpm packages for amd64 and arm64 locally, using stub binaries.
• release:pre and release dry run against a local bare remote (stopped at the GitHub step as expected).
• CI passes on this PR for both arches, including sanitize.
• After merge: run Pre release, then Release, and check the GitHub release assets.