Publish pipeline: goreleaser + Maven Central + npm (#1)

* feat(cli): add Version var and version subcommand

* build(gradle): introduce uatu.version property for lockstep releases

* build(sdk-android): swap GitHub Packages for vanniktech Maven Central plugin

* build(spec-api): make package publish-ready for npm

* ci(release): add goreleaser config for cross-platform uatu CLI builds

* ci: add ci and release GitHub Actions workflows

* ci: restrict ci.yml to PR + workflow_dispatch (no direct push to master)

* docs(release): add local release targets, env example, and install docs

* build(sdk-android): make signAllPublications conditional on signing key

* ci(release): stage sidecar JAR at embed path before go build

* chore(spec-api): regenerate package-lock for updated package.json

* ci: install protoc-gen-go plugins before buf generate

* ci: bump Node to 22 (required for --experimental-strip-types)

gradle.properties

@@ -3,3 +3,8 @@ org.gradle.parallel=true
 org.gradle.caching=true
 kotlin.code.style=official
 android.useAndroidX=true
+
+# Single source of truth at release time is the git tag (e.g. v0.1.0 → 0.1.0),
+# forwarded via `-Puatu.version=...` or `ORG_GRADLE_PROJECT_uatu.version`.
+# The default below only applies to untagged local builds.
+uatu.version=0.0.0-dev