Add QA test outputs, build scripts, and Dockerfile validation

- Created `qa-test-output-after-fix.txt` and `qa-test-output.txt` to log results of certificate page authentication tests.
- Added `build.sh` for deterministic backend builds in CI, utilizing `go list` for efficiency.
- Introduced `codeql_scan.sh` for CodeQL database creation and analysis for Go and JavaScript/TypeScript.
- Implemented `dockerfile_check.sh` to validate Dockerfiles for base image and package manager mismatches.
- Added `sourcery_precommit_wrapper.sh` to facilitate Sourcery CLI usage in pre-commit hooks.

.github/workflows/release-goreleaser.yml

@@ -0,0 +1,59 @@
+name: Release (GoReleaser)
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+  packages: write
+
+jobs:
+  goreleaser:
+    runs-on: ubuntu-latest
+    env:
+      # Use the built-in CHARON_TOKEN by default for GitHub API operations.
+      # If you need to provide a PAT with elevated permissions, add a CHARON_TOKEN secret
+      # at the repo or organization level and update the env here accordingly.
+      CHARON_TOKEN: ${{ secrets.CHARON_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6
+        with:
+          go-version: '1.25.5'
+
+      - name: Set up Node.js
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
+        with:
+          node-version: '24.11.1'
+
+      - name: Build Frontend
+        working-directory: frontend
+        run: |
+          # Inject version into frontend build from tag (if present)
+          VERSION=$${GITHUB_REF#refs/tags/}
+          echo "VITE_APP_VERSION=$$VERSION" >> $GITHUB_ENV
+          npm ci
+          npm run build
+
+      - name: Install Cross-Compilation Tools (Zig)
+        uses: goto-bus-stop/setup-zig@v2
+        with:
+          version: 0.13.0
+
+      # CHARON_TOKEN is set from CHARON_TOKEN or CPMP_TOKEN (fallback), defaulting to GITHUB_TOKEN
+
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6
+        with:
+          distribution: goreleaser
+          version: latest
+          args: release --clean
+        # CGO settings are handled in .goreleaser.yaml via Zig