[27Bslash6]

Adds .github/workflows/release.yml and an install section in the README.

A version tag (v0.1.0, v0.2.0-rc.1) runs four jobs, all on GitHub-hosted runners:

1. check: the tag must equal v plus the crate version, the tagged commit must be on main, and cargo package --locked must build.
2. build: static musl binaries for x86_64 and aarch64 Linux and a binary for Apple silicon. Each job runs the test suite on its own target before it builds. These jobs hold only contents: read, so dependency build scripts never see a signing or publishing token.
3. release: attests each archive and the ck binary inside it with actions/attest (the action attest-build-provenance now wraps), then creates the GitHub Release. A tag with a - makes a pre-release.
4. publish: exchanges the job's OIDC token for a short-lived crates.io token (trusted publishing, release environment) and runs cargo publish. It runs last because a crates.io version can never be republished.

No installer script ships. The README documents cargo install --locked cachekit-cli and the pinned verify command, and says why --owner cachekit-io alone is not enough.

Before the first tag, the crate must exist on crates.io with this workflow registered as its trusted publisher, and the repository must be public, because artifact attestations need a public repository on this plan.

Closes LAB-5117