publish.yml: hut version (not --version)

Caught by job 141 install_hut step. `hut` doesn't expose a --version
flag; the subcommand is `hut version`. `go install` had succeeded
silently and the failure was just the version probe.

Bump VERSION to 0.1.0 for tag

Add goreleaser + CHANGELOG.md; cross-platform downloads on site

* .goreleaser.yml — builds linux/{amd64,arm64} and darwin/{amd64,arm64}
  as raw binaries (formats: binary) with CGO_ENABLED=0, trimpath, version
  ldflag injection. GitHub release disabled; we publish via pages.sr.ht.

* CHANGELOG.md — Keep-a-Changelog format. v0.1.0 entry summarizes the
  full surface (init/doctor, single-file/docker/dir caching, --hash-from,
  Garage compat, e2e suite, CI manifests).

* .builds/publish.yml — installs goreleaser binary release (pinned to
  v2.7.0), runs `goreleaser release --clean --skip=publish`, flattens
  the 4 dist/cacher_<os>_<arch>_v<n>/cacher paths into
  pages/cacher-<os>-<arch>, regenerates checksums.txt to match the
  published filenames, renders CHANGELOG.md to HTML via cmark with
  heading demotion (h1→drop, h2→h3, h3→h4), substitutes per-platform
  sha256s into docs/index.html, and ships everything to
  bigbes.pages.srht.bigb.es/ci-cacher/ plus the build artifacts list.

* docs/index.html — Download section is now a 4-row table with per-
  platform sha256s, plus a Changelog section that embeds the rendered
  CHANGELOG.md inline.

Add docs/index.html landing page; publish.yml substitutes build info

Replaces the inline 4-line index.html written in publish.yml with a
proper text-mostly landing page under docs/index.html — sections for
what it is, install, the loop it replaces, commands, why, and a
'this build' block populated at publish time from VERSION, SHA-256,
and build timestamp via sed.

Single-column, ~44rem max width, system fonts, monospace for code,
dark-mode via prefers-color-scheme. No JS, no images, no remote
assets. ~130 lines of HTML+CSS.

Fix pages.sr.ht target: bigbes.pages.srht.bigb.es/ci-cacher

cacher.srht.bigb.es was a guess and isn't configured. Use the
user-level pages domain (bigbes.pages.srht.bigb.es) with hut's
`-s /ci-cacher` subpath flag so this manifest only touches files
under that prefix — leaves room for other projects under the same
domain without clobbering.

Add builds.sr.ht CI: unit, e2e, and tag-only publish

Three independent manifests under .builds/ (within the 4-build-per-push
cap):

* unit.yml — ubuntu/noble, go test ./..., smoke ./cacher version. Runs
  on master and tags.

* e2e.yml — ubuntu/noble + docker.io, runs the testcontainers e2e suite
  (go test -tags=e2e). Pulls dxflrs/garage:v2.3.0 per Garage container.
  Runs on master and tags.

* publish.yml — tag-only. Builds linux-amd64 static binary, ships it
  two ways: as a build artifact (visible on the job page, 90-day TTL)
  and via hut pages publish to cacher.srht.bigb.es with a minimal
  index.html and embedded sha256 for verification. Uses
  oauth: pages.sr.ht/PAGES:RW so no manual secret registration needed.

Go is installed from upstream tarball in every manifest because
ubuntu/noble's golang-go is too old for the go.mod requirement
(1.26.3). hut is built from source in publish.yml since it's not
packaged for noble.

README install snippet updated to point at the pages URL.

Add end-to-end test suite against real Garage via testcontainers

* internal/testutil/garage: spins up dxflrs/garage:v2.3.0 with
  --single-node --default-bucket so the bucket + access key are
  auto-created from env vars at startup, no CLI bootstrap dance.
  Each Start() call yields a fresh container with random creds and
  registers t.Cleanup teardown.

* e2e_test.go gated by build tag e2e exercises the compiled cacher
  binary against the container — covers init/doctor parity (the
  regression guard for the HeadBucket+signature bugs we hit on
  the real bucket), single-file round-trip, exit codes (1/2/3),
  URL fallback + cache fill, --hash-from parity with sha256sum,
  directory tar+zstd round-trip, and delimited list output.

* just test-e2e recipe; requires Docker on the host.

Total runtime ~30s after first image pull (~1.5s/container).

Fix Garage compat: PingBucket via ListObjects, fixed config path, delimited list

Three issues surfaced when first running doctor against the real
s3.bigb.es Garage instance:

* HeadBucket returned 403 even with valid creds. Garage doesn't
  implement HeadBucket the way AWS does. Switch the doctor smoke
  test to a 1-key ListObjectsV2 — matches what aws s3 ls does, which
  the existing shell helper used.

* Config landed in ~/Library/Application Support/cacher on macOS
  via os.UserConfigDir. cacher is a CI tool that needs the same
  path on a dev mac and on a Linux build runner, so hard-code
  ~/.config/cacher/config.toml unconditionally.

* cacher list flat-listed every object under the configured prefix.
  Add Delimiter="/" semantics by default (matches aws s3 ls), with
  --recursive for the previous behaviour and --root to ignore the
  configured prefix and list at the bucket root.

Add BSD-2-Clause license and README

Copyright header matches the convention used in go-luarocks.
README walks through install, init/doctor, single-file and docker
caching, the new directory caching, key derivation, config
precedence, Garage compatibility, and exit codes.

Initial cacher v0.0.1-dev — S3-backed CI cache helper

Replaces tarantool-protobuf/.builds/lib/ci-lib.sh (and its
two shell helpers s3_cache_or_curl + s3_cache_docker_image)
with a single static Go binary.

Commands:
  init / doctor          persist config + smoke-test credentials
  download / upload      single-file cache with URL fallback + sha256
  exists / list / delete cache management
  key                    resolve key template (for shell scripting)
  docker {exists,download,upload}  streamed save/load via zstd
  dir {download,upload}            tar+zstd directory caching (new)

Key derivation via --hash-from <path> (repeatable; file or dir),
matching the existing sha256sum | cut -c1-16 shell convention.
Garage-compatible S3 client (path-style, checksums when_required).