ci: automate releases with release-please

[phatpham9]

Summary

Automate releases with release-please on main, while keeping image publication in the existing tag-driven CD workflow.

What changed

• add .github/workflows/release-please.yml
  • runs on pushes to main
  • requires RELEASE_PLEASE_TOKEN
  • uses the documented minimal release-please setup with release-type: go
  • creates/updates the release PR, tags, and GitHub Releases through release-please
• update .github/workflows/cd.yml
  • grant contents: write so the workflow can edit GitHub Releases
  • after GHCR publish, ensure a release exists and idempotently append the container pull instructions

Notes

• the GHCR image tag produced by the current docker/metadata-action config is 1.0.0, not v1.0.0, because type=semver,pattern={{version}} strips the v prefix
• the CD workflow now writes release pull instructions using the correct image tag form
• until RELEASE_PLEASE_TOKEN is configured in repository secrets, the new workflow will fail fast with an explicit error on pushes to main

Follow-up for reviewer

Before merging, add a repository secret named RELEASE_PLEASE_TOKEN backed by a PAT or GitHub App token with repository write permissions so release-please-created tags can trigger downstream workflows.