GitHub rejects `secrets.*` references in `if:` expressions at workflow-parse
time. Move secrets to job-level env vars so conditional steps can safely
check for their presence before running import-codesign-certs and codesign.
Add GitHub Actions workflow for automated canary builds (macOS/Linux, x86_64/ARM64) with optional macOS code signing. Extend `f upgrade` with `--canary` and `--stable` flags to switch between release channels. Ensure both `f` and `flow` entrypoints work via symlinks in install script and after upgrade.
- Add macOS code signing to release workflow with Apple Developer ID
- Add `f push` command for syncing to private mirror remotes
- Add `f release signing` subcommands (status/store/sync) for managing certs
- Improve install script with configurable repos and GitHub auth support
- Update readme with public install instructions and maintainer docs
- Introduce GitHub Actions workflow at .github/workflows/release.yml to publish on v* tags
- Add GoReleaser config for multi-target releases (.goreleaser.yaml)
- Add packaging script at scripts/package-release.sh to build and package release artifacts
- Update installer logic to support versioned releases and binary URL fallback
- Update docs/readme with release process and install guidance
