feat: report the build version and aggregate the platform's; add release automation

[flaccid]

Closes #2. Part of kube-workspaces/deploy#2.

Version at runtime

Nothing recorded which version was running. The Dockerfile built with no
-ldflags, there was no version variable, and no endpoint reported one — so the
only signal was the image tag, which is latest in the default manifests and
therefore says nothing.

Surface	Output
--version	v0.3.0 (commit abc1234, built …, linux/amd64, go1.26.7)
startup log	same, structured
GET /platform/version	JSON

Defaults are dev/unknown, so a plain go build still works.

/platform/version aggregates the whole platform

The API is the natural place to answer "what is this cluster running?", so the
endpoint reports its own compiled-in build plus the image each of the four
components is actually running:

{
  "api": {
    "version": "v0.3.0", "commit": "abc1234", "buildDate": "…",
    "go": "go1.26.7", "platform": "linux/amd64"
  },
  "images": {
    "controller": "ghcr.io/kube-workspaces/controller:v0.3.0",
    "api":        "ghcr.io/kube-workspaces/api:v0.3.0",
    "proxy":      "ghcr.io/kube-workspaces/proxy:v0.3.0",
    "frontend":   "ghcr.io/kube-workspaces/frontend:v0.3.0"
  }
}

It reads pod specs rather than calling each component's own /version, which
avoids assuming the other components are healthy — precisely the situation in
which you most want this endpoint.

Auth

Exempt from the auth middleware and from maintenance mode. Identifying a
deployment is diagnostic, not privileged, and needing a session to read it
defeats the purpose during an incident; it exposes nothing beyond component image
tags.

The maintenance exemption was broadened from /platform/config to /platform/
to cover both, since both are used to diagnose maintenance mode.

debug.ReadBuildInfo() is not a substitute: it reports (devel) for a build
not driven by go install module@version, which is the case for the container
build.

The workflow passes VERSION from docker/metadata-action rather than
reconstructing it, so the image tag and the reported version cannot drift.

Release automation

Adds the release workflow and .github/release.yml categories, identical across
the five repositories. The note preamble comes from a shared generator in the
deploy repo which states explicitly when a release has no functional changes —
relevant here, since this component is often tagged only to hold the platform
version line. Defaults to a dry run.

Verification

• go build, go vet, go test ./cmd/... ./internal/... all pass
• --version verified locally

Note

cmd/kube_workspaces/http.go and internal/auth/config.go have pre-existing
gofmt deviations. I left them untouched rather than mixing unrelated formatting
churn into this diff, but they are worth a separate cleanup.