[groupsky]

Sets up the repository for all later work (#2).

• go.mod (github.com/code6x/nodkey, Go 1.26 minimum) and cmd/nodkey with a version subcommand.
• CI: go test -race, go vet, gofmt, golangci-lint, govulncheck (also weekly, and a weekly scan of the latest release binaries).
• golangci-lint with security linters. forbidigo blocks printing and global logging in library code, so secret values cannot be printed by accident.
• A PR title check (Conventional Commits).
• release-please, in a release environment that only main can use. It skips itself until the owner sets up a GitHub App. On a release: static Linux binaries (amd64, arm64) built in a read-only job, SHA256SUMS, a build provenance attestation, then the draft release is published.
• Dependabot for Go modules and GitHub Actions.
• Every action is pinned to a full commit SHA.
• docs/releasing.md: how releases work and the one-time setup.

Review: two rounds of security review by a subagent (8 findings, all fixed). Repo settings changed with it: squash commits use only the PR title, SHA pinning is required for actions, immutable releases are on, and the release environment allows only main with no admin bypass. Rulesets for main and v* tags follow right after this merge, because the title check runs from main.

Closes #2