Switch CI pipelines to GitHub/Forgejo Actions using ci-base container
image, simplify Makefile by removing tools/bin versioned-symlink pattern,
update Containerfile with multi-stage build for CA certs and non-root
user, and clean up GoReleaser config with ldflags and explicit release
target.