feat(release): version stamping and tag-triggered release workflow

--version/-V on the CLI, version in /api/health via Server.SetVersion,
Makefile/Dockerfile ldflags stamping from git describe, and a release
workflow on v* tags: both binaries for linux/darwin (amd64+arm64) and
windows/amd64 with SHA256SUMS attached to the Gitea release
(idempotent — reuses an existing hand-written release and skips
already-uploaded assets), plus version-tagged Docker images.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

cmd/exploredns/main.go

@@ -13,6 +13,9 @@ import (
 	"gitea.hansenits.com.au/hits/ExploreDNS/internal/traverse"
 )
 
+// version is stamped at build time via -ldflags "-X main.version=...".
+var version = "dev"
+
 func main() {
 	cfg := config.DefaultConfig()
 
@@ -42,6 +45,12 @@ func main() {
 	flag.BoolVar(&dFlag, "debug", false, "Print debug diagnostics to stderr")
 	flag.BoolVar(&ddFlag, "dd", false, "Like -d plus library-level debug")
 
+	// Version: long and short form share the same variable (mirrors
+	// dnstraverse's -V).
+	var showVersion bool
+	flag.BoolVar(&showVersion, "version", false, "Print version and exit")
+	flag.BoolVar(&showVersion, "V", false, "Print version and exit (shorthand)")
+
 	// Quiet: long and short form share the same variable.
 	var quietVal bool
 	flag.BoolVar(&quietVal, "quiet", cfg.Quiet, "Suppress the header block")
@@ -69,6 +78,11 @@ func main() {
 
 	flag.Parse()
 
+	if showVersion {
+		fmt.Printf("exploredns %s\n", version)
+		return
+	}
+
 	args := flag.Args()
 
 	cfg.QueryType = *queryType