feat: add packaging + experimental workflows for testing

[seantronsen]

Description

Adds packaging and the workflows that exercise the OpenCHAMI/github-actions v4 workflows (OpenCHAMI/github-actions#41) end to end, releases included. Stacked on the Go testbed source PR (seantronsen/add-testbed-code).

• .goreleaser.yaml covering every release effect: binaries, archives, dockers_v2 multi-arch image, rpm/deb via nfpm, signing, attestations, GitHub release.
• Quadlet packaging: container unit, drop-in, config (config|noreplace), shared rpm/deb scripts, deb copyright.
• The full org workflow set (build, release, lint, test, reuse, govulncheck, dependency-review, scorecard, cleanup, stale), pinned to the github-actions branch under test.

Note

Releases sign with a throwaway key generated per run (test-key job); packages here must not be trusted. Tag freely: nothing depends on this repo's images, packages, or releases.

Important

Repo settings still needed: Coveralls enrollment (coverage upload fails until then), CodeQL default setup, and branch protection requiring build, lint, test, reuse, govulncheck, and dependency-review.

Checklist

• My code follows the style guidelines of this project
• I have added/updated comments where needed
• I have added tests that prove my fix is effective or my feature works
• I have run make test (or equivalent) locally and all tests pass
• I have updated the relevant documentation (CLI examples, man pages, README, other docs, etc.)
• DCO Sign-off: All commits are signed off (git commit -s) with my real name and email
• REUSE Compliance:
  • Each new/modified source file has SPDX copyright and license headers
  • Any non-commentable files include a <filename>.license sidecar
  • All referenced licenses are present in the LICENSES/ directory

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Dependency update
• Build system/CI

---

• I agree to follow the Code of Conduct.