ci: migrate releases to shared pipeline

[steipete]

Summary

Move crawlkit publication to the shared release-go-cli.yml@v1 pipeline and deliberately align its release assets with the fleet convention. Local publishing now refuses with the workflow-dispatch command, while snapshot and downloaded-asset verification remain diagnostic paths.

This is a breaking release-asset rename beginning with v0.14.4:

v0.14.3 asset	v0.14.4 replacement
crawlctl-v0.14.3-macos-arm64.tar.gz	crawlkit_0.14.4_darwin_arm64.tar.gz
crawlctl-v0.14.3-macos-arm64.tar.gz.sha256	entry in checksums.txt
crawlctl-v0.14.3-macos-x86_64.tar.gz	crawlkit_0.14.4_darwin_amd64.tar.gz
crawlctl-v0.14.3-macos-x86_64.tar.gz.sha256	entry in checksums.txt
none	crawlkit_0.14.4_linux_arm64.tar.gz
none	crawlkit_0.14.4_linux_amd64.tar.gz

The archive prefix is crawlkit_ because the shared workflow's supported default and validation contract derive it from the repository name; there is no existing binary-name override, and this migration intentionally does not add one. The executable inside every archive remains crawlctl.

Linux amd64 and arm64 are enabled because crawlctl cross-builds cleanly with CGO_ENABLED=0 for both targets and has no blocking native dependency or build tag. There is no Homebrew handoff, universal Darwin archive, or nFPM packaging.

Proof

• make check
• actionlint
• goreleaser check
• goreleaser release --snapshot --clean --skip=publish,announce,validate
• all four snapshot archive entries validated against dist/checksums.txt
• Linux outputs inspected as static x86-64 and ARM aarch64 ELF executables
• Codex autoreview completed with no accepted/actionable findings; its sole reported input-contract concern was rejected after checking the exact live release-workflows@v1 tag, which declares all used inputs