chore(receiver): packaging, k8s manifests, CI/release, docs

Dockerfile.receiver (CGO-free, /data volume), receiver image in CI and
tag releases, receiver binary in release archives, make build-receiver,
example k8s manifests (deployment/service/ingress/secret/pvc) under
deploy/k8s/receiver/, and README coverage including sender/receiver
token pairing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Makefile

@@ -1,12 +1,13 @@
 BINARY_NAME=exploredns
 SERVER_BINARY_NAME=exploredns-server
+RECEIVER_BINARY_NAME=exploredns-receiver
 BUILD_DIR=bin
 GO=go
 GOFLAGS=-v
 VERSION?=$(shell git describe --tags --always 2>/dev/null || echo dev)
 LDFLAGS=-ldflags "-X main.version=$(VERSION)"
 
-.PHONY: build build-server build-all test lint clean cover deploy deploy-status
+.PHONY: build build-server build-receiver build-all test lint clean cover deploy deploy-status
 
 build:
 	$(GO) build $(GOFLAGS) $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME) ./cmd/exploredns
@@ -14,7 +15,10 @@ build:
 build-server:
 	$(GO) build $(GOFLAGS) $(LDFLAGS) -o $(BUILD_DIR)/$(SERVER_BINARY_NAME) ./cmd/server
 
-build-all: build build-server
+build-receiver:
+	$(GO) build $(GOFLAGS) $(LDFLAGS) -o $(BUILD_DIR)/$(RECEIVER_BINARY_NAME) ./cmd/exploredns-receiver
+
+build-all: build build-server build-receiver
 
 test:
 	$(GO) test -v -race -coverprofile=coverage.out ./...