Add cmsctl release workflow + makefile install targets

- platform/Makefile: 'cmsctl' build target (static CGO_ENABLED=0) and
  'install-cmsctl' to ~/.local/bin (BIN_DIR overridable)
- .gitea/workflows/cmsctl-release.yml: tag-driven (cmsctl-v*) Gitea
  release action building linux/darwin amd64+arm64 binaries + sha256s

Makefile

@@ -1,5 +1,26 @@
 
 
+# ━━━ cmsctl build + install ━━━
+# Builds the cmsctl CLI. Pure Go, no cgo/build tags needed.
+#
+#   make cmsctl           # build to ./bin/cmsctl
+#   make install-cmsctl   # build + install to ~/.local/bin
+#
+# Override BIN_DIR to install elsewhere: make install-cmsctl BIN_DIR=/usr/local/bin
+BIN_DIR ?= $(HOME)/.local/bin
+
+.PHONY: cmsctl install-cmsctl
+cmsctl:
+	@mkdir -p bin
+	CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o bin/cmsctl ./cmd/cmsctl
+	@echo "Built bin/cmsctl"
+
+install-cmsctl: cmsctl
+	@mkdir -p $(BIN_DIR)
+	@cp bin/cmsctl $(BIN_DIR)/cmsctl
+	@chmod 0755 $(BIN_DIR)/cmsctl
+	@echo "Installed $(BIN_DIR)/cmsctl"
+
 # ━━━ Pre-commit hook (forbid root binaries) ━━━
 .PHONY: install-hooks
 install-hooks: