feat: matrix mode — plan command + release --only / --pin-version

[blairham]

Closes #5.

What

Splits deciding from building so CI can fan one runner out per build group — almost like a matrix build, because it is one:

• stevedore plan — resolves per-image versions, runs change detection (marker refs / --changed-since / --only-changed), applies build-once grouping, and prints the plan as one compact JSON line without building. include is GitHub Actions matrix shape: one entry per build group with ids, only (csv), per-member versions, ready-made pins flags, and the build reason. Skipped images are listed with their reason. Progress → stderr; stdout carries only the document.
• release --only <ids> — builds exactly those images, unconditionally (selection was the planner's decision). Unknown ids fail fast.
• release --pin-version id=ver (repeatable) — tags exactly what the plan resolved. Pinned images skip remote version resolution entirely, so a matrix job needs no registry read for versioning.
• Markers advance on any real push — previously only in marker-detection mode; --only matrix jobs and --changed-since runs now keep every image's baseline current (the marker records last released, not last marker-diffed).
• action.yml — command: plan exposes the document as the plan output for strategy.matrix.

jobs:
  plan:
    outputs: {matrix: ${{ steps.plan.outputs.plan }}}
    steps:
      - uses: blairham/stevedore@v1
        id: plan
        with: {command: plan}
  build:
    needs: plan
    if: ${{ fromJson(needs.plan.outputs.matrix).include[0] != null }}
    strategy: {matrix: ${{ fromJson(needs.plan.outputs.matrix) }}}
    steps:
      - uses: blairham/stevedore@v1
        with: {command: release, args: --only ${{ matrix.only }} ${{ matrix.pins }}}

How

The eval/group pre-pass is extracted from Release into evaluateImages/groupPlans (internal/pipeline/plan.go) and shared by both paths — existing modes behave identically.

Verified

• make check green (lint + race tests); new table tests for grouping, plan rendering, --only filtering/validation, pin parsing and precedence.
• Against real multi-image configs (live ECR): a 5-member identical-spec group plans as one entry with per-member versions (and picks up marker refs previously advanced by a different CI system); 13 build-arg-distinct images plan as 13 entries with .csproj-graph change reasons; release --only dis --pin-version dis=X --dry-run builds just that image with the pinned tag and no registry access.