Migrate CI from Cirrus CI to GitHub Actions

[fkorotkov-oai]

What changed

• replace Cirrus CI lint, Linux, macOS, and release jobs with GitHub Actions
• keep GoReleaser binary releases and multi-architecture Docker image publishing
• publish GitHub releases and the Homebrew tap update with short-lived GitHub App tokens
• expose release and signing credentials only to the GoReleaser steps that consume them
• reserve the publish environment for tag releases while keeping manual snapshots environment- and secret-free
• publish Formula/orchard.rb to openai/homebrew-tools through a versioned pull request
• remove nfpm/Fury publishing and obsolete system-package assets
• build the container directly with Go instead of installing GoReleaser Pro in the Dockerfile
• publish the image as ghcr.io/openai/orchard and source Vetu from openai/vetu in Linux CI

Release setup

Configure these secrets on the publish environment before the next release:

• RELEASE_APP_ID
• RELEASE_APP_PRIVATE_KEY
• GORELEASER_KEY
• the existing macOS signing and notarization values

The release app needs contents write access to openai/orchard, plus contents and pull-request write access to openai/homebrew-tools.

Only the tag-triggered release job uses the publish environment. Manual workflow_dispatch snapshots run without release, signing, or notarization secrets.

Validation

• actionlint .github/workflows/release.yml
• actionlint -ignore 'label ".*" is unknown' .github/workflows/*.yml
• goreleaser check --soft with GoReleaser Pro 2.16.0
• credential-free goreleaser release --skip=publish --snapshot --clean, which generated dist/homebrew/Formula/orchard.rb and skipped signing/notarization
• go test ./... passed outside hardware-dependent integration packages

GoReleaser reports that formula-style brews output is deprecated in favor of casks. This PR intentionally preserves Orchard's formula packaging and its install-time shell completion generation.

The local hardware integration tests could not register an Orchard worker because ioreg is unavailable in this execution environment; the migrated macOS job runs them on the Tahoe runner.