Publish pipeline: goreleaser + Maven Central + npm (#1)

* feat(cli): add Version var and version subcommand

* build(gradle): introduce uatu.version property for lockstep releases

* build(sdk-android): swap GitHub Packages for vanniktech Maven Central plugin

* build(spec-api): make package publish-ready for npm

* ci(release): add goreleaser config for cross-platform uatu CLI builds

* ci: add ci and release GitHub Actions workflows

* ci: restrict ci.yml to PR + workflow_dispatch (no direct push to master)

* docs(release): add local release targets, env example, and install docs

* build(sdk-android): make signAllPublications conditional on signing key

* ci(release): stage sidecar JAR at embed path before go build

* chore(spec-api): regenerate package-lock for updated package.json

* ci: install protoc-gen-go plugins before buf generate

* ci: bump Node to 22 (required for --experimental-strip-types)

.gitignore

@@ -30,3 +30,9 @@ node_modules/
 # Sidecar fat JAR — build artifact copied in by `make uatu` before
 # `go build -tags withsidecar`. Never commit: it's ~130 MB.
 internal/sidecar/assets/sidecar-all.jar
+
+# spec-api compiled output
+pkg/spec-api/dist/
+
+# goreleaser local output
+dist/