chore(release): goreleaser + CI workflows + v2 demo GIFs

Release infrastructure:
- .goreleaser.yml: builds 5-platform binaries (darwin/linux/windows
  x amd64/arm64), SHA-256 checksums, pre-release detection for -rc tags
- .github/workflows/release.yml: runs on any 'v*' tag — test -> build
  -> publish via goreleaser-action
- .github/workflows/ci.yml: test + vet + race detector on every push
  to main / v2-* and every PR
- .gitignore: extended to cover scan artifacts (gods-eye-*.json,
  report-*.json, *.stderr), YAML configs (god-eye.yaml, .god-eye.yaml),
  IDE state (.idea, .vscode, .cursor), Claude Code working notes
  (CLAUDE.md, .claude/), and the /god-eye build artifact

Demo GIFs recorded live against scanme.nmap.org (Nmap's authorized
test host):
- assets/wizard-demo.gif (272 KB): interactive setup walkthrough
- assets/live-scan.gif (37 KB): colorized event stream
- assets/ai-verbose.gif (122 KB): full AI cascade + end-of-scan brief

Legacy v0.1 assets removed:
- assets/demo.gif
- assets/demo-ai.gif

.gitignore

@@ -38,11 +38,21 @@ go.work.sum
 *.txt
 /results/
 /output/
+# Scan artifacts anywhere in the tree (defence in depth)
+gods-eye-*.json
+gods-eye-*.stderr
+scan-*.json
+scan-*.csv
+report-*.json
+findings-*.json
 
 # Sensitive files
 secrets.yaml
 config.local.yaml
 .env.*
+god-eye.yaml
+.god-eye.yaml
+/.god-eye/
 
 # Logs
 *.log
@@ -51,3 +61,15 @@ config.local.yaml
 # OS files
 .DS_Store
 Thumbs.db
+
+# Editor / IDE / AI-agent local state
+.idea/
+.vscode/
+# Claude Code working notes — intentionally NOT public
+CLAUDE.md
+.claude/
+.cursor/
+.cursorrules
+
+# Benchmark captures with potentially sensitive output
+BENCHMARK-SCANME.local.md