Add tag-triggered release pipeline for 0.1.0 (PyPI wheel, Release binaries, Homebrew) #3

Plan (optional)

codellm-devkit/.github — docs/superpowers/plans/2026-09-02-codeanalyzer-iac-helm-backend.md (Plan Completion Gate names the 0.1.0 artifact/release path; the pipeline itself was out of that plan's scope).

Problem

codeanalyzer-iac (PR #2) is complete and gate-green but has no tag-triggered release pipeline. Nothing can be tagged v0.1.0 until the thin PyPI wheel, GitHub Release binaries with checksums, and Homebrew formula are produced by CI, so the analyzer is not yet consumable by python-sdk or typescript-sdk.

Scope boundary

In: packaging/python/ thin wheel (codeanalyzer_iac.bin_path()), .github/workflows/release.yml mirroring codeanalyzer-typescript (tag verify → test gate → single-host Go cross-compile → wheel smoke test → GitHub Release assets + SHA256 → PyPI Trusted Publishing → separate homebrew job to codellm-devkit/homebrew-tap), README Architecture & Tooling note on the single-host build strategy, make build version lockstep (-X main.version).
Out: SDK pin bumps (own issues in python-sdk / typescript-sdk once v0.1.0 exists), docs-site pages, any analyzer behavior change.

Goals

• git tag v0.1.0 && git push origin v0.1.0 produces PyPI codeanalyzer-iac==0.1.0 platform wheels, a GitHub Release with per-platform caniac binaries and checksums, and a Homebrew formula, in one run.
• A failed test gate deletes the tag; a failed Homebrew push does not mark the PyPI/Release run red.
• analyzer.version in emitted JSON equals the tag version.

Caveats and known risks

• live.yml pins codeanalyzer-schema@e127901; that branch is now pushed but not merged to main in the schema repo.
• PyPI Trusted Publishing and HOMEBREW_TAP_TOKEN need org-level setup before the first tag.
• Go cross-compilation is CGO-free today; verify the Helm SDK dependency tree stays CGO-free on every target.

Definition of done

• release.yml and packaging/python/ present; workflow_dispatch dry run passes on a v0.1.0-rc tag or equivalent.
• Wheel smoke test runs caniac --version on each platform wheel.
• v0.1.0 tagged from the merged main; PyPI, GitHub Release, and Homebrew artifacts exist with matching version and checksums.
• README install section shows pip install codeanalyzer-iac and brew install codeanalyzer-iac.