Make the release path explicit and single-pass

[siliconwitch]

Summary

• let the GoReleaser snapshot remain the single vet, test, and release-build pass in CI
• spell out the fresh branch, checks, commit, cleanup, and tag commands for a CLI release
• state explicitly that production releases remain human-owned

Verification

• GoReleaser snapshot completed successfully
• all Linux, macOS, and Windows amd64/arm64 archives built
• GoReleaser hooks passed go mod verify, go vet, and go test
• gofmt and go mod tidy checks
• git diff --check