chore: release-please and shared release workflows

[ccf-lisa]

Why

The plugin joins the release flow: release-please opens release PRs, and the shared release-go-plugin.yml publishes a release when it's published, instead of a goreleaser run on any pushed tag.

Default branch: main. The base of this PR is main, and every push: branches: trigger here uses [main]. The shared workflows called here read the default branch from the event or the API, so nothing in them assumes a branch name.

What changes

• release-please-config.json: the shared defaults from workflows release-please/defaults.json at v1.5.2 (no drift), with packages: {".": {"release-type": "go"}}.
• .release-please-manifest.json: seeded at 0.4.0, the latest final release (v0.4.0, an ancestor of main). The first release PR should propose 0.4.1 (one fix(deps) commit since, fix(deps): bump compliance-framework/agent to v0.9.1 #32).
• New callers, all pinned to workflows v1.5.2 (6e7fc9c): release-please.yml (push to main), release.yml (release: published, protocol-version: "2"), preview.yml (kind: go-plugin, on-main: false, so only the preview label publishes :pr-<n>) and cut-prerelease.yml (workflow_dispatch, rc tags vX.Y.Z-rcN).
• ci.yml: pins moved from v1.5.1 to v1.5.2. It already calls release-checks.yml.
• .goreleaser.yaml: adds release: {prerelease: auto, replace_existing_artifacts: true}. The shared job refuses to run without prerelease: auto and warns without replace_existing_artifacts. Builds (binary: plugin, linux and darwin) and archives are unchanged.

Deleted

• .github/workflows/build-and-upload.yml: reusable job that ran goreleaser and uploaded dist/ with gooci to :<tag> and :latest.
• .github/workflows/release.yml (old content, replaced by the new caller of the same name): on any tag push, called build-and-upload.yml.

Published artifacts: old vs new

	Old (tag push)	New (release: published)
Trigger	push of any tag (*)	GitHub release published by release-please or cut-prerelease (tags are vX.Y.Z / vX.Y.Z-rcN)
GitHub release	created by goreleaser from the tag	created by release-please; goreleaser attaches the archives to it
Release assets	5 archives + checksums	same names; same contents (README.md, plugin; the repo has no LICENSE), since the builds and archives config is unchanged
OCI tags	:<tag> and :latest	:vX.Y.Z, plus :latest only for a final tag
rc handling	latest was gated on github.event.release.prerelease, which is empty on a tag push, so an rc tag (e.g. the old v0.2.0-rc) also moved latest	an rc publishes only :vX.Y.Z-rcN; latest is untouched
latest digest	a second, separate upload (v0.4.0 and latest are different digests today)	crane tag points latest at the vX.Y.Z manifest: one digest
Upload	gooci upload --annotate=org.ccf.plugin.protocol.version=2 dist/	same command and annotation
Tool versions	goreleaser ~> v2, gooci @latest	goreleaser v2.18.2, gooci v0.0.7, crane v0.20.7

One visible difference: the latest index's org.opencontainers.image.ref.name / org.opencontainers.image.version annotations will read vX.Y.Z instead of latest, because latest is now the same manifest as the version tag. The published :v0.4.0 index today carries org.ccf.plugin.protocol.version=2 and the platforms linux/386, linux/amd64, linux/arm64, darwin/amd64, darwin/arm64, which the snapshot reproduces.

Verified locally

• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12: clean.
• go build ./... and go test ./...: pass.
• goreleaser check and goreleaser release --snapshot --clean (v2.16.0): dist/ has plugin-local-ssh_{Darwin_arm64,Darwin_x86_64,Linux_arm64,Linux_i386,Linux_x86_64}.tar.gz (each README.md, plugin) and a checksums file, the same asset names as the v0.4.0 release.
• release-please-config.json compared with workflows release-please/defaults.json at v1.5.2: no differing keys.

The README's "Releases" section names goreleaser and the releases and packages pages; it doesn't mention tag pushes or the old workflows, so it is unchanged here.

This PR stays open until the batch's repo settings are applied (the release environment holds the ccf-release-bot secrets release-please needs).

Task: W3-S2-T01 (local-dev/docs/release-automation/workstream-3-plugins-in-train.md)

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: d3f243aa-06cd-4038-a9c6-6b1835f89a0f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gusfcarvalho]

Checked: release-please seed, shared release callers pinned to workflows v1.5.2, ci / required green. Batch 1 repo settings are applied.