pruefbyte local, embedded OCR and installable releases

[testudor]

Summary

pruefbyte local: run the CI review before pushing

• Reviews the current branch the way the CI job reviews its merge request, and prints the findings instead of posting them.
• It covers commits plus staged, unstaged and untracked changes; --committed limits it to commits. It reads them from a snapshot commit built with a throwaway index, so the user's index, branch and files are untouched.
• Uses the same code as CI for:
  • loading config: .pruefbyte.yml and OCR rule files at the merge base
  • merging rules
  • OCR options
  • severity filtering
  • the fail_on_severity exit code (3)
• A test runs one branch through both paths and checks that OCR gets identical arguments, rules and provider settings.
• The API key is the first one found of:
  • PRUEFBYTE_LLM_API_KEY
  • the developer's own OCR config (api_key, or api_key_cmd run in the real environment)
  • the provider's env var
• No GitLab token is needed. --format json gives machine-readable output.

Config

• .pruefbyte.yml may set llm.provider (OCR built-ins only), so provider and model live in the repo and GitLab variables hold only secrets.
• A repo can choose the provider only when the global config leaves it unset, so a merged repo file can't send the operator's shared key to another vendor.

Embedded OCR and installation

• Release binaries (GoReleaser, build tag embedocr) embed the gzip-compressed OCR pinned in internal/ocrbin/VERSION.
• The OCR binaries are downloaded for all six platforms and checked against OCR's published checksums. At runtime the binary is unpacked into the user cache directory and checked again.
• Resolution order: ocr.binary if set, then the built-in copy, then ocr on the PATH.
• The Docker image uses the same VERSION file. Archives ship LICENSE.open-code-review.
• The module is now github.com/feinarbyte/pruefbyte, so go install …@latest works (without OCR; that path needs ocr on the PATH).
• v* tags publish a GitHub release with archives for Linux, macOS and Windows on amd64 and arm64. Archive names carry no version, so releases/latest/download/… URLs stay stable.
• The README documents mise, curl, PowerShell, Go and Docker installs.
• CI's build job now runs a GoReleaser snapshot of all six binaries with OCR embedded, with the OCR downloads cached.

Two /code-review high --fix passes ran. Their fixes are included, along with fixes for the findings they left open.

Test plan

• go test ./...: local vs CI equivalence, snapshot leaves the repo untouched, repo provider rules, api_key_cmd, OCR unpacking (first use, reuse, tamper, checksum mismatch)
• golangci-lint shows 0 issues with and without -tags embedocr; actionlint and goreleaser check pass
• Real OCR v1.12.10: pruefbyte local ran end to end on this repo, with both PATH OCR and embedded OCR, failing as expected on an invalid key; the repo was unchanged
• GoReleaser snapshot: six archives of 17–19 MB, each with both licenses
• Docker image builds and runs the pinned OCR
• This PR's CI, including the first GoReleaser build on GitHub
• After merging: tag v0.1.0, then check the release assets, the curl/PowerShell install and mise use -g github:feinarbyte/pruefbyte
• A real review with a valid API key

🤖 Generated with Claude Code