Add release workflow and Dockerfile

[ewels]

Summary

• .github/workflows/release.yml — multi-arch build/release pipeline adapted from ruSTAR. Runs binary + Docker builds on every push to main to catch breakage; creates GitHub Release + tags Docker manifests only on workflow_dispatch.
  • Binary matrix: Linux x86_64/aarch64, macOS x86_64/aarch64, Windows x86_64-msvc. Tarballs + sha256 attached to the release.
  • Docker: native amd64 / arm64 runners -> multi-arch manifest pushed to ghcr.io/ewels/fastqc-rust with vX.Y.Z, X.Y, X, latest, dev tags.
  • publish-crate job scaffolded but gated if: false. Comment explains the bootstrap path (first cargo publish manually, then configure trusted publisher, then flip the gate).
  • Version is read from Cargo.toml; Cargo.lock is checked to match; tag collision is caught before any builds upload.
• Dockerfile — two-stage build, rust:1-bookworm -> debian:bookworm-slim. Installs zlib1g-dev/zlib1g for the default native-zlib feature, plus ca-certificates and procps (Nextflow's trace mode needs ps). Final image ~107 MB.

Built & smoke-tested the Docker image locally (fastqc --version, ps --version both work).

Test plan

• Merge and confirm the first main push runs build-binaries + docker-build + docker-merge green end-to-end.
• Confirm the dev tag appears at ghcr.io/ewels/fastqc-rust:dev and is multi-arch.
• Bump Cargo.toml to a new version on a follow-up PR, merge, then trigger Release via workflow_dispatch — expect a new vX.Y.Z git tag, a GitHub Release with 5 binary tarballs, and tagged Docker manifests (vX.Y.Z, X.Y, X, latest).
• Separately: run cargo publish manually once to bootstrap the crate on crates.io, then wire up crates.io trusted publisher and flip publish-crate's if: false.