CI and release automation via GitHub Actions

ci.yml: make test on every push/PR, Linux only - matches the README's
own honest claim that Linux is the only platform actually run and
verified, rather than having CI pretend untested platforms are
behaviorally covered. A separate cross-build job runs make release on
the same Linux runner as a build-only check across every platform in
the Makefile's matrix (CGO_ENABLED=0 + pure-Go SQLite means no
macOS/Windows runner is needed just to catch a compile break).

release.yml: fires on a v* tag, runs make release, packages each
platform into a single archive (.tar.gz Unix, .zip Windows) plus a
SHA256SUMS file, and attaches them to a GitHub Release via the gh CLI
rather than a third-party action - matches this project's own general
preference for minimizing external dependencies.

Verified the packaging shell logic locally (not the YAML itself, which
needs a real Actions run) against a real make release output: all 6
platform archives build with correct internal structure, zip selected
only for Windows, SHA256SUMS covers all of them.

1 files changed, 6 insertions, 1 deletions

diff --git a/README.md b/README.md
index 7acd262..edb62e4 100644
--- a/README.md
+++ b/README.md
@@ -97,7 +97,12 @@ itself for the rest - `make install` (via `go install`, respecting
 `GOBIN`/`GOPATH` as usual), `make release` (cross-compiles both
 binaries for every platform in `PLATFORMS` into `dist/`), `make test`
 (the same build/vet/gofmt/test checks expected before every commit -
-see `PLAN.md`). Building without `make` works identically:
+see `PLAN.md`). Pushing a `v*` tag runs the same `make release` in CI
+and attaches the resulting archives (one per platform, `.tar.gz` on
+Unix/`.zip` on Windows, `SHA256SUMS` alongside them) to a GitHub
+Release, once this repo actually lives on GitHub - see
+`.github/workflows/release.yml`. Building without `make` works
+identically:
 
 ```sh
 go build -o bin/mitmuxd ./cmd/mitmuxd