build: release a static image with scripts/release.sh

The image now packages a cross-compiled musl binary on distroless instead of
compiling inside Docker. The script builds it, pushes :<version> and :latest
to git.cosocial.info, and tags the commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -36,3 +36,24 @@ cargo run --bin setup -- declare   # label definitions; gives the account a Subs
 cargo run --bin setup -- did       # run after deploying; requires labeler account's main password + emailed code
 ```
 
+## Release
+
+Releases are made manually with the Rust toolchain. `scripts/release.sh` cross-compiles a static
+linux/amd64 binary, packages it into a container image, pushes
+`git.cosocial.info/cosocial-canada/atproto-cosocial-labeler:<version>` and `:latest`, and tags the
+commit as `v<version>`. It refuses to run with uncommitted changes or an existing tag.
+
+Prerequisites (once):
+
+```sh
+brew install zig                       # linker and C compiler for cross-compiling
+cargo install --locked cargo-zigbuild
+docker login git.cosocial.info         # token with the write:package scope
+```
+
+The pinned toolchain and its `x86_64-unknown-linux-musl` target come from `rust-toolchain.toml`.
+Docker must be running. Then:
+
+```sh
+scripts/release.sh 0.1.0
+```