[backtrack5r3 (tomflenner)]

What does this PR change?

Everything needed to install kaiten with one command on each platform, and to package every release:

• install/install.sh (Linux, macOS) and install/install.ps1 (Windows): detect OS and architecture, download the release archive, verify its SHA-256 against the release's checksums.txt, install the binary. Both accept a version and an install directory; the shell script uses sudo only when the target directory actually needs it, and the PowerShell one installs under %LOCALAPPDATA%\Programs\kaiten and adds it to the user PATH, no administrator rights.
• GoReleaser (.goreleaser.yaml) now also produces: .deb, .rpm and .apk packages (binary, completions, LICENSE and NOTICE in each format's convention); a multi-platform ghcr.io/kaitencloud/cli image on a distroless non-root base. The archives now carry shell completions too.
• Archives and packages are named kaiten_<os>_<arch>.* without the version, so releases/latest/download/<asset> is a stable URL for all twelve of them. The install scripts rely on that.
• Automated releases with release-please, modeled on open-feature/cli. release.yml now runs on every push to main: release-please keeps one chore: release X.Y.Z PR open with the next semver version (computed from Conventional Commits) and the CHANGELOG.md entry. Merging that PR tags vX.Y.Z and creates the GitHub release, and the goreleaser job in the same run attaches the archives, packages and the GHCR image, plus SLSA build-provenance attestations. The hand-pushed tag trigger is gone; workflow_dispatch re-publishes an existing tag if GoReleaser fails after tagging. Pre-1.0: feat/breaking → minor, fix → patch, first release 0.1.0.
• pr-title.yml: a PR title check (Conventional Commits) on pull_request_target, like DCO, since the squash-merge title is what release-please reads. CONTRIBUTING and the PR template say what each type releases.
• ci.yml (lint job): goreleaser check, shellcheck on the shell installer and a PowerShell parse of the Windows one, so a broken installer or release config fails the PR rather than the tag.
• Taskfile.yml: task release:snapshot builds the whole release into dist/ without a tag; task release:check runs the same checks as CI (GoReleaser, shellcheck, PowerShell parse).
• README: an Installation section per platform (macOS, Linux, Windows, container, Go, binaries, pinning a version, shell completion) and a Releasing subsection describing the release-please flow and its one-time setup.

Before merging: one-time setup

1. Create a GitHub App (org-owned), install it on kaitencloud/cli with Contents, Pull requests and Issues read/write. Put its ID in the Actions variable RELEASE_APP_ID and its private key in the Actions secret RELEASE_APP_PRIVATE_KEY. Without it the release PR would be opened by GITHUB_TOKEN, which starts no workflow, so the required checks would never run on it.
2. Merge this PR with squash, so the changelog reads its title rather than the individual commits.
3. After the first release: make the cli GHCR package public. Keep immutable releases off (GoReleaser attaches assets to the release release-please already published).

Recommended, not required: add PR title to the ruleset's required checks, restrict merges to squash, and add a tag ruleset on v* that only the release App can create.

Modeled on dapr/cli (per-OS install scripts, "latest release" resolution) and open-feature/cli (container image, checksum verification in the script).

Why?

A public CLI is only as usable as its install path. Until now the options were go install or unpacking an archive by hand.

Testing

• goreleaser check (v2.12.7, the pinned version): clean, no deprecation warnings (uses dockers_v2, not the phased-out dockers).
• goreleaser release --snapshot locally: all six binaries, archives, .deb/.rpm/.apk and both container images build. Verified with dpkg -c, rpm -qlp/rpm -qLp and tar -t that every package carries the binary, the completions, LICENSE and NOTICE; ran the arm64 image.
• install/install.sh against the snapshot served over local HTTP: installs and prints the version; creates a missing nested install directory as the user, not root; refuses a tampered checksum and a missing checksum entry without writing anything; builds the right GitHub URL for a pinned version.
• install/install.ps1 under pwsh on macOS against the same server: downloads, verifies, extracts and places kaiten.exe; refuses a tampered checksum before extracting; rejects an unsupported architecture. (Running the .exe is the one step that cannot be exercised off Windows.)
• shellcheck --shell=sh, PowerShell parser, go build, go vet, go test, golangci-lint: all clean.
• After the rebase on main and the release-please changes: task release:check passes (and fails on a deliberately broken install.ps1); goreleaser release --snapshot --skip=publish,docker builds all 12 assets with changelog.disable and release.mode: append; actionlint is clean on release.yml and pr-title.yml. release-please itself can only run once this is on main: the first push opens the chore: release 0.1.0 PR.

Not in this PR

• Homebrew and Scoop were in the first revision and are dropped for now (second and third commits): neither kaitencloud/homebrew-tap nor kaitencloud/scoop-bucket exists yet. The removed blocks are in commit e417a77 if they come back. Publishing still needs nothing beyond GITHUB_TOKEN; only release-please uses the App token.
• No release yet, so releases/latest/download/… returns 404 until the first release PR is merged.

Checklist

• I have read CONTRIBUTING.md.
• Every commit in this PR includes a valid DCO Signed-off-by line.
• I have the right to submit all material in this PR.
• I have not included secrets or confidential data.
• I have updated tests where appropriate.
• I have updated documentation where appropriate.
• I have preserved required third-party licenses and attributions.

🤖 Generated with Claude Code