chore(ci): externalize workflow scripts and relocate main flow doc (#722)

* feat: Add GitHub Actions workflows for security audits, CodeQL analysis, contributor updates, performance benchmarks, integration tests, fuzz testing, and reusable Rust build jobs

- Implemented `sec-audit.yml` for Rust package security audits using `rustsec/audit-check` and `cargo-deny-action`.
- Created `sec-codeql.yml` for CodeQL analysis scheduled twice daily.
- Added `sync-contributors.yml` to update the NOTICE file with new contributors automatically.
- Introduced `test-benchmarks.yml` for performance benchmarks using Criterion.
- Established `test-e2e.yml` for running integration and end-to-end tests.
- Developed `test-fuzz.yml` for fuzz testing with configurable runtime.
- Created `test-rust-build.yml` as a reusable job for executing Rust commands with customizable parameters.
- Documented main branch delivery flows in `main-branch-flow.md` for clarity on CI/CD processes.

* ci(workflows): update workflow scripts and rename for clarity; remove obsolete lint feedback script

* chore(ci): externalize workflow scripts and relocate main flow doc

.github/workflows/pub-release.yml

@@ -0,0 +1,143 @@
+name: Release
+
+on:
+    push:
+        tags: ["v*"]
+
+concurrency:
+    group: release
+    cancel-in-progress: false
+
+permissions:
+    contents: write
+    id-token: write # Required for cosign keyless signing via OIDC
+
+env:
+    CARGO_TERM_COLOR: always
+
+jobs:
+    build-release:
+        name: Build ${{ matrix.target }}
+        runs-on: ${{ matrix.os }}
+        timeout-minutes: 40
+        strategy:
+            fail-fast: false
+            matrix:
+                include:
+                    - os: ubuntu-latest
+                      target: x86_64-unknown-linux-gnu
+                      artifact: zeroclaw
+                    - os: macos-latest
+                      target: x86_64-apple-darwin
+                      artifact: zeroclaw
+                    - os: macos-latest
+                      target: aarch64-apple-darwin
+                      artifact: zeroclaw
+                    - os: windows-latest
+                      target: x86_64-pc-windows-msvc
+                      artifact: zeroclaw.exe
+
+        steps:
+            - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+            - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
+              with:
+                  targets: ${{ matrix.target }}
+
+            - uses: useblacksmith/rust-cache@f53e7f127245d2a269b3d90879ccf259876842d5 # v3
+
+            - name: Build release
+              run: cargo build --release --locked --target ${{ matrix.target }}
+
+            - name: Check binary size (Unix)
+              if: runner.os != 'Windows'
+              run: |
+                  SIZE=$(stat -f%z target/${{ matrix.target }}/release/${{ matrix.artifact }} 2>/dev/null || stat -c%s target/${{ matrix.target }}/release/${{ matrix.artifact }})
+                  SIZE_MB=$((SIZE / 1024 / 1024))
+                  echo "Binary size: ${SIZE_MB}MB ($SIZE bytes)"
+                  echo "### Binary Size: ${{ matrix.target }}" >> "$GITHUB_STEP_SUMMARY"
+                  echo "- Size: ${SIZE_MB}MB ($SIZE bytes)" >> "$GITHUB_STEP_SUMMARY"
+                  if [ "$SIZE" -gt 15728640 ]; then
+                    echo "::error::Binary exceeds 15MB hard limit (${SIZE_MB}MB)"
+                    exit 1
+                  elif [ "$SIZE" -gt 5242880 ]; then
+                    echo "::warning::Binary exceeds 5MB target (${SIZE_MB}MB)"
+                  else
+                    echo "Binary size within target."
+                  fi
+
+            - name: Package (Unix)
+              if: runner.os != 'Windows'
+              run: |
+                  cd target/${{ matrix.target }}/release
+                  tar czf ../../../zeroclaw-${{ matrix.target }}.tar.gz ${{ matrix.artifact }}
+
+            - name: Package (Windows)
+              if: runner.os == 'Windows'
+              run: |
+                  cd target/${{ matrix.target }}/release
+                  7z a ../../../zeroclaw-${{ matrix.target }}.zip ${{ matrix.artifact }}
+
+            - name: Upload artifact
+              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              with:
+                  name: zeroclaw-${{ matrix.target }}
+                  path: zeroclaw-${{ matrix.target }}.*
+                  retention-days: 7
+
+    publish:
+        name: Publish Release
+        needs: build-release
+        runs-on: blacksmith-2vcpu-ubuntu-2404
+        timeout-minutes: 15
+        steps:
+            - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+            - name: Download all artifacts
+              uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+              with:
+                  path: artifacts
+
+            - name: Install syft
+              run: |
+                  curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
+
+            - name: Generate SBOM (CycloneDX)
+              run: |
+                  syft dir:. --source-name zeroclaw -o cyclonedx-json=artifacts/zeroclaw.cdx.json -o spdx-json=artifacts/zeroclaw.spdx.json
+                  {
+                    echo "### SBOM Generated"
+                    echo "- CycloneDX: zeroclaw.cdx.json"
+                    echo "- SPDX: zeroclaw.spdx.json"
+                  } >> "$GITHUB_STEP_SUMMARY"
+
+            - name: Generate SHA256 checksums
+              run: |
+                  cd artifacts
+                  find . -type f \( -name '*.tar.gz' -o -name '*.zip' -o -name '*.cdx.json' -o -name '*.spdx.json' \) -exec sha256sum {} + | sed 's|  \./[^/]*/|  |' > SHA256SUMS
+                  echo "Generated checksums:"
+                  cat SHA256SUMS
+
+            - name: Install cosign
+              uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
+
+            - name: Sign artifacts with cosign (keyless)
+              run: |
+                  for file in artifacts/**/*; do
+                    [ -f "$file" ] || continue
+                    cosign sign-blob --yes \
+                      --oidc-issuer=https://token.actions.githubusercontent.com \
+                      --output-signature="${file}.sig" \
+                      --output-certificate="${file}.pem" \
+                      "$file"
+                  done
+
+            - name: Create GitHub Release
+              uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
+              with:
+                  generate_release_notes: true
+                  files: |
+                      artifacts/**/*
+                      artifacts/SHA256SUMS
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}