CI/CD overhaul: hardened Docker image, unified releases, and security fixes

[LordOverlord]

Summary

This PR consolidates multiple CI/CD and Docker-related changes into a single, coherent release workflow.

It addresses security findings, simplifies the Docker image, and unifies how binaries and container images are built, versioned, and released.

---

What was done

• Docker image cleanup

  • Simplified Dockerfile
  • Reduced attack surface
  • Removed unnecessary layers and artifacts

• Security hardening

  • Reworked build steps to address high-severity vulnerabilities
  • Fixed Snyk scanning issues (image reference normalization, tag handling)

• GitHub Actions overhaul

  • Unified release flow for Docker images and binaries
  • Deterministic semantic versioning
    • dev: vX.Y.Z-dev.N (prerelease)
    • master: vX.Y.Z (stable)
  • Version and short commit SHA embedded into:
    • binaries
    • Docker image builds
  • Concurrency and idempotent tagging to avoid race conditions

• Binary releases

  • OS-specific artifacts published to GitHub Releases
  • Filenames include version and platform
  • Release metadata clearly marked as prerelease or stable

---

Why

Previously, the pipeline had overlapping responsibilities and non-deterministic behavior, which caused:

• Tag collisions
• Inconsistent Docker/binary versions
• Security tooling failures

This PR makes the release process:

• Predictable
• Traceable
• Safer to re-run
• Explicit about prerelease vs stable artifacts

---

How to validate

• Push to dev
  • Expect a prerelease like vX.Y.Z-dev.N
  • Docker tags: :dev and :vX.Y.Z-dev.N
• Merge to master
  • Expect a stable vX.Y.Z
  • Docker tags: :latest and :vX.Y.Z
• Verify runtime version:

  ctop -v
  

---

Notes

• No runtime or functional behavior changes
• CI/CD and release infrastructure only

---