Add a Makefile and attach binaries to releases !22

Stacked on !21; retarget to main once that merges.

make build (embed tag, -trimpath, version from git describe), make test, make lint, make dist (tarballs for linux/amd64, linux/arm64, darwin/arm64, freebsd/amd64 with config, docs, service files and SHA256SUMS), make clean. Ran build and dist locally.

The GitHub release workflow gains a binaries job on v* tags: builds the tarballs inside golang:1.25 (no new pinned action) and uploads them with gh to the release of the tag, creating it with generated notes if the image job did not. dist/ is ignored.

Closes #34