Release setup: tarballs, Gitea workflow, apt registry

make dist builds tarballs for linux/amd64 and linux/arm64. A pushed v*
tag runs .gitea/workflows/release.yml, which checks the tag against
VERSION and the CHANGELOG, tests, builds the tarballs and the .debs
(amd64, arm64) and publishes them with scripts/gitea-release.sh: a Gitea
release, and the .debs in the Debian registry (stable, or testing for a
release candidate). As in Housecarl and Steward; no cli-dist, Guard is
Linux only. docs/development.md has the steps, docs/install.md the apt
source.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Makefile

@@ -6,6 +6,11 @@
 #   sudo make install install the binary, completion, systemd unit and sysusers file,
 #                     and an example /etc/guard/guard.yaml
 #   make deb          the Debian package in dist/ (DEB_ARCH=arm64 for another architecture)
+#   make dist         static binaries for linux/amd64 and linux/arm64 in dist/
+#                     (guard-<version>-linux-<arch>.tar.gz)
+#
+# Guard is Linux only (it reads the journal), so there is no cli-dist as in
+# Housecarl and Steward.
 
 VERSION ?= $(shell cat VERSION 2>/dev/null || echo 0.0.0-dev)
 RELEASE_TAG ?= $(shell t=v$(VERSION); git tag --points-at HEAD 2>/dev/null | grep -qx "$$t" && git diff --quiet HEAD 2>/dev/null && echo $$t)
@@ -30,7 +35,7 @@ DEB_DEV_VERSION := $(shell [ -n '$(DESCRIBE)' ] || exit 0; \
 	echo '$(DESCRIBE)' | sed -E 's/^v(.*)-([0-9]+)-g([0-9a-f]{7})[0-9a-f]*$$/\1+git\2.g\3/' | tr - '~' | sed "s/$$/$$m/")
 DEB_VERSION ?= $(if $(RELEASE_TAG),$(subst -,~,$(VERSION)),$(or $(DEB_DEV_VERSION),$(subst -,~,$(VERSION))))
 
-.PHONY: all build completion test e2e install install-files uninstall deb clean
+.PHONY: all build completion test e2e install install-files uninstall deb dist clean
 
 all: build
 
@@ -81,5 +86,11 @@ uninstall:
 deb: build
 	DEB_ARCH=$(DEB_ARCH) DEB_VERSION=$(DEB_VERSION) VERSION=$(VERSION) LDFLAGS="$(LDFLAGS)" GOFLAGS="$(GOFLAGS)" scripts/mkdeb.sh
 
+dist: build
+	for arch in amd64 arm64; do \
+		GOOS=linux GOARCH=$$arch go build $(GOFLAGS) -ldflags "$(LDFLAGS)" -o dist/guard-$(VERSION)-linux-$$arch/guard ./cmd/guard && \
+		tar -C dist -czf dist/guard-$(VERSION)-linux-$$arch.tar.gz guard-$(VERSION)-linux-$$arch || exit 1; \
+	done
+
 clean:
 	rm -rf bin dist