Release binaries for linux amd64 and arm64

Pushing a v* tag runs .github/workflows/release.yml: vet, test,
govulncheck, then scripts/build-release.sh builds reproducible archives
for linux/amd64 and linux/arm64 with a SHA256SUMS file, and attaches
them to the release. workflow_dispatch takes a tag for a run that never
started. Same shape as ihasmail-oneshot's releases.

Adds a version subcommand, set at build time.

go.mod moves to 1.26.8: the workflow builds with the go.mod version,
and govulncheck finds four standard-library vulnerabilities the tool
reaches in 1.26.5 (GO-2026-6218, GO-2026-6090, GO-2026-5972,
GO-2026-5026), all fixed in 1.26.6.

README installs from the latest release, with building from source as
the alternative; CONTRIBUTING describes how releases are cut.

scripts/build-release.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+# SPDX-FileCopyrightText: 2026 Coffey Labs
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# Build the release archives: one per architecture, plus SHA256SUMS.
+#
+# Usage: scripts/build-release.sh VERSION [OUTDIR]
+#        scripts/build-release.sh v2026.9.15 dist
+#
+# The release workflow runs exactly this, so a release can be reproduced -- or
+# checked before tagging -- on any machine with Go. Archive names carry no
+# version, so .../releases/latest/download/<name> always means the newest.
+set -euo pipefail
+
+VERSION="${1:?usage: $0 VERSION [OUTDIR]}"
+OUT="${2:-dist}"
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+
+rm -rf "$OUT" && mkdir -p "$OUT"
+OUT="$(cd "$OUT" && pwd)"
+STAGE="$(mktemp -d)"
+trap 'rm -rf "$STAGE"' EXIT
+
+# Linux only: the tool runs as root on the mail server it upgrades, which is a
+# systemd service or a Docker container there.
+for arch in amd64 arm64; do
+  name="stalwart-migrate-linux-$arch"
+  mkdir -p "$STAGE/$name"
+  echo "==> building $name ($VERSION)"
+  (cd "$ROOT" && CGO_ENABLED=0 GOOS=linux GOARCH="$arch" go build -trimpath \
+    -ldflags "-s -w -X main.version=$VERSION" -o "$STAGE/$name/stalwart-migrate" ./cmd/stalwart-migrate)
+  cp "$ROOT/LICENSE" "$ROOT/README.md" "$STAGE/$name/"
+  # Fixed owner and time, so the same commit gives the same archive.
+  tar --sort=name --owner=0 --group=0 --numeric-owner --mtime="@${SOURCE_DATE_EPOCH:-0}" \
+    -C "$STAGE/$name" -czf "$OUT/$name.tar.gz" stalwart-migrate LICENSE README.md
+done
+
+(cd "$OUT" && sha256sum ./*.tar.gz | sed 's| \./| |' > SHA256SUMS)
+echo "==> $OUT:"
+(cd "$OUT" && cat SHA256SUMS)