feat: add tag-triggered release pipeline (PyPI wheel, Release binaries, Homebrew)

[rahlk]

Closes #3.

Tag-triggered release for codeanalyzer-iac, mirrored from the codeanalyzer-typescript reference with Bun replaced by single-host, CGO-free Go cross-compilation.

What is added

• packaging/python/: hatchling project codeanalyzer-iac; console scripts caniac and codeanalyzer-iac; codeanalyzer_iac.bin_path(); build_wheels.sh builds five platform wheels (linux amd64/arm64, macOS x86_64/arm64, windows amd64) carrying the binary under _bin/; PEP 440 version guard.
• packaging/homebrew/generate_formula.sh, packaging/install/caniac-installer.sh.
• .github/workflows/release.yml: v*.*.* trigger plus workflow_dispatch; version verified against the tag; make vet && make test && make schema-check as a hard gate; wheel build and smoke test; a single delete-tag step on any pre-publish failure; GitHub Release with per-asset SHA256; PyPI via Trusted Publishing with skip-existing; isolated homebrew job; contents: write and id-token: write on the release job only, contents: read on homebrew.
• make wheels; README install section and tag-format rule.

Version lockstep

The tag is the only source: build_wheels.sh stamps __version__, the Go binary gets -X main.version, and the emitted analyzer.version is the same string. The workflow checks caniac --version against the tag.

Verified locally

Five wheels built from PKG_VERSION=0.1.0rc0; fresh venv pip install of the host wheel prints caniac version 0.1.0rc0, bin_path() resolves inside site-packages, a fixture analysis runs from the installed binary; linux and windows wheels carry _bin/caniac[.exe]; formula sha256 values match shasum -a 256; actionlint, shellcheck, go test ./..., gofmt -l, git diff --check clean. PKG_VERSION=0.1.0-dev is rejected with a readable message.

Two departures from the reference, on purpose

• The reference gates tests with continue-on-error plus steps.test.conclusion == 'failure'; conclusion is post-continue-on-error and always success, so that gate never fires. Here the test step fails the job outright and one if: failure() step deletes the tag. Same defect exists in the TypeScript and Python analyzers' workflows; follow-on issues to be filed.
• No repo-level discussion_category_name: Discussions are disabled on this repo and the field would 422 the Release step. The org-level announcement (best effort) stays.

Before the first tag (outside this PR)

PyPI project codeanalyzer-iac with a Trusted Publisher for codellm-devkit/codeanalyzer-iac / release.yml; repo secret HOMEBREW_TAP_TOKEN; optional ORG_DISCUSSIONS_TOKEN. Tags must be PEP 440 normalized (v0.1.0, v0.1.0rc1).