ci(woodpecker): release pipeline on vX.Y.Z tag

Runs 'go test ./...' then 'goreleaser release --clean' inside the
official goreleaser image when a tag matching refs/tags/v* is pushed.
GITHUB_TOKEN comes from the 'github_token' repo secret (needs repo +
write:packages scopes) and is reused for ghcr.io docker login so the
multi-arch image build can push.

Runner requirements documented inline: docker socket access plus QEMU
registered on the host (tonistiigi/binfmt --install all) for arm64
cross-builds. Directory form chosen so a non-release CI pipeline can
land later under .woodpecker/ci.yml without restructuring.

.woodpecker/release.yml

@@ -0,0 +1,41 @@
+# Release pipeline — runs when a vX.Y.Z tag is pushed.
+#
+# Builds gnoma via GoReleaser:
+#   - static binaries for linux/darwin/windows × amd64/arm64
+#   - archives + checksums + changelog uploaded to the GitHub mirror's
+#     releases page (via the GoReleaser github backend in .goreleaser.yml)
+#   - multi-arch container images pushed to ghcr.io/vikingowl91/gnoma
+#
+# Secrets required (set in Woodpecker repo settings):
+#   github_token   GitHub PAT with `repo` + `write:packages` scopes.
+#                  Used for both the release upload and the ghcr.io
+#                  image push.
+#
+# Runner requirements:
+#   - Docker socket access (mounted via volumes below).
+#   - QEMU registered on the host for arm64 cross-builds. One-time:
+#       docker run --privileged --rm tonistiigi/binfmt --install all
+#     If your Woodpecker host doesn't have it and you can't grant
+#     privileged, drop arm64 from .goreleaser.yml or run releases
+#     manually until a runner with QEMU is available.
+
+when:
+  - event: tag
+    ref: refs/tags/v*
+
+steps:
+  - name: test
+    image: golang:1.26
+    commands:
+      - go test ./...
+
+  - name: release
+    image: goreleaser/goreleaser:latest
+    environment:
+      GITHUB_TOKEN:
+        from_secret: github_token
+    commands:
+      - echo "$GITHUB_TOKEN" | docker login ghcr.io -u VikingOwl91 --password-stdin
+      - goreleaser release --clean
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock