Add a static Linux release pipeline

[Jimbo4350]

Context

cardano-sieve had no release machinery: no CI, no LICENSE file, no changelog, no --version, and a build that only linked because of a gitignored cabal.project.local. This PR adds the cardano-api release process (herald: changelog fragments per PR, a dispatchable Release workflow that opens a release PR, a signed cardano-sieve-A.B.C.D tag) without the CHaP upload, and a CI build that turns that tag into fully static Linux binaries (x86_64, aarch64) attached to a GitHub Release. Haskell PVP versions; first release will be 0.1.0.0; no Docker image yet.

What's in it

• .github/workflows/build.yml — runs on cardano-sieve-* release tags only (plus workflow_dispatch for a dry run that uploads the tarballs as workflow artifacts without releasing). The devx toolchain (ghc98-static-minimal-iog) arrives as a prebuilt closure via input-output-hk/actions/devx, so nothing is compiled with nix. The cabal store is cached on the freeze file. The verify step asserts the binary is statically linked and, on tags, that --version matches the tag. The package step tars bin/cardano-sieve (stripped) with bash/zsh completions and the licence. On tags, a release job publishes the two tarballs, a sha256sums.txt, and the matching CHANGELOG.md section as the GitHub Release.
• .github/workflows/check-pr-changelog.yml — herald-validate on every PR (fragment present, pr: matches), as in cardano-api.
• .github/workflows/release.yml — herald-release on workflow_dispatch: computes the PVP version from fragments (or takes an explicit one), opens the release/cardano-sieve-A.B.C.D PR with the changelog section and cabal bump, and prints the signing/tagging commands. chap-instructions: false.
• .herald.yml, .changes/ — herald config (kinds copied from cardano-api) and the initial-release fragment for this PR.
• cabal.project.release — imports cabal.project and adds what a static musl link needs (executable-static, text -simdutf, formatting +no-double-conversion, blockio +serialblockio). Kept separate so dev builds don't rebuild the store.
• --version via optparse-applicative's simpleVersioner and Paths_cardano_sieve.
• LICENSE (Apache-2.0, matching the cabal file), CHANGELOG.md (herald header), RELEASING.md, scripts/ci/extract-changelog.sh (herald section format).
• README installation section; usage examples now call the installed binary.

How to trust this PR

Local dry run of the exact release recipe (via the same devx entrypoint CI uses) (devx 5f05c1e, GHC 9.8.4, cabal.project.release):

• file → ELF 64-bit LSB executable, x86-64, statically linked; 208 MB unstripped, 124 MB stripped, 30 MB gzipped.
• cardano-sieve --version → cardano-sieve 0.1.0.0; +RTS --info → rts_thr, GHC 9.8.4.
• Runs unmodified inside alpine:3.20 (no glibc).
• Served the preview benchmark DB (--serve): /health reports version and checkpoint, /matches?unspent pages with X-Next-Cursor, /checkpoints answers, clean SIGTERM shutdown.
• cabal test — 62/62 pass with the --version change. actionlint clean; all actions SHA-pinned.

The two static builds ran green on this PR's earlier revisions (before the triggers were narrowed to release tags): x86_64 30 min and aarch64 26 min cold. A release rehearsal on a throwaway tag exercised the release job end to end (assets, checksums, notes) and was then deleted. herald validate --diff --pr 7 and a herald batch --dry-run --version 0.1.0.0 were run locally against this branch.

Follow-ups (not here)

• macOS aarch64 runner (dynamic against system libs, ad-hoc codesign).
• Container image to ghcr.io/intersectmbo/cardano-sieve reusing the static artifact.
• Migrate to a haskell.nix flake + Hydra download-only workflow once a Hydra jobset exists.

CI

First (cold-cache) run on this PR: x86_64-linux 30 min, aarch64-linux 26 min. Both binaries verified statically linked, --version = cardano-sieve 0.1.0.0, threaded RTS; tarballs ~30 MB.