CI and release automation via GitHub Actions

ci.yml: make test on every push/PR, Linux only - matches the README's
own honest claim that Linux is the only platform actually run and
verified, rather than having CI pretend untested platforms are
behaviorally covered. A separate cross-build job runs make release on
the same Linux runner as a build-only check across every platform in
the Makefile's matrix (CGO_ENABLED=0 + pure-Go SQLite means no
macOS/Windows runner is needed just to catch a compile break).

release.yml: fires on a v* tag, runs make release, packages each
platform into a single archive (.tar.gz Unix, .zip Windows) plus a
SHA256SUMS file, and attaches them to a GitHub Release via the gh CLI
rather than a third-party action - matches this project's own general
preference for minimizing external dependencies.

Verified the packaging shell logic locally (not the YAML itself, which
needs a real Actions run) against a real make release output: all 6
platform archives build with correct internal structure, zip selected
only for Windows, SHA256SUMS covers all of them.

1 files changed, 28 insertions, 0 deletions

diff --git a/PLAN.md b/PLAN.md
index e95622c..bf30b0c 100644
--- a/PLAN.md
+++ b/PLAN.md
@@ -747,3 +747,31 @@ numbers orange, booleans/null magenta, punctuation gray, confirmed
 against the raw captured ANSI codes, not just eyeballed - and the
 request tab (never JSON, never pretty-printed) rendered as plain
 unstyled text, unaffected.
+
+## CI and release automation
+
+`.github/workflows/ci.yml`: `make test` (build/vet/gofmt/test) on
+every push/PR, Linux only - matches the README's own honest claim that
+Linux is the only platform actually run and verified, rather than
+pretending untested platforms are behaviorally covered by CI. A
+separate `make release` job cross-compiles every platform in the
+Makefile's matrix on the same Linux runner (`CGO_ENABLED=0` + pure-Go
+SQLite means this needs no macOS/Windows runner at all) as a build-only
+check - catches a platform-specific compile break without paying for
+real hardware to do it.
+
+`.github/workflows/release.yml`: fires on a `v*` tag push, runs `make
+release`, packages each platform's directory into a single archive
+(`.tar.gz` Unix, `.zip` Windows - whatever each platform's own tools
+already handle, no extra install required to unpack one) alongside a
+`SHA256SUMS` file, and attaches them to a GitHub Release created from
+the tag. Uses the `gh` CLI (preinstalled and pre-authenticated via the
+runner's own `GITHUB_TOKEN` on every GitHub-hosted runner) rather than
+a third-party Marketplace action for the actual release creation -
+matches this project's own general preference for minimizing external
+dependencies (see e.g. pure-Go SQLite over CGO). Verified locally: ran
+the exact packaging shell logic (not the YAML itself, which needs a
+real Actions run to execute) against a real `make release` output -
+confirmed all 6 platform archives (2 macOS, 2 Linux, 1 Windows, 1
+FreeBSD) build with correct internal structure, `zip` selected only
+for the Windows target, and `SHA256SUMS` covers all of them.