build: release a static image with scripts/release.sh

The image now packages a cross-compiled musl binary on distroless instead of
compiling inside Docker. The script builds it, pushes :<version> and :latest
to git.cosocial.info, and tags the commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/release.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Cuts a release: cross-compiles a static linux/amd64 binary, pushes it as a
+# container image (:<version> and :latest), and tags the commit.
+#
+#   scripts/release.sh 0.1.0
+#
+# Needs: zig + cargo-zigbuild, Docker running, and
+# `docker login git.cosocial.info` with a write:package token.
+set -euo pipefail
+
+version="${1:?usage: scripts/release.sh <version>}"
+image="git.cosocial.info/cosocial-canada/atproto-cosocial-labeler"
+target="x86_64-unknown-linux-musl"
+
+if [[ -n "$(git status --porcelain)" ]]; then
+  echo "working tree is dirty; commit first" >&2
+  exit 1
+fi
+if git rev-parse -q --verify "refs/tags/v$version" >/dev/null; then
+  echo "tag v$version already exists" >&2
+  exit 1
+fi
+
+cargo zigbuild --release --target "$target" --bin cities-labeler
+docker build --platform linux/amd64 -t "$image:$version" -t "$image:latest" .
+docker push "$image:$version"
+docker push "$image:latest"
+
+git tag -a "v$version" -m "v$version"
+git push origin "v$version"
+echo "released $image:$version"