Add builds.sr.ht CI: unit, e2e, and tag-only publish

Three independent manifests under .builds/ (within the 4-build-per-push
cap):

* unit.yml — ubuntu/noble, go test ./..., smoke ./cacher version. Runs
  on master and tags.

* e2e.yml — ubuntu/noble + docker.io, runs the testcontainers e2e suite
  (go test -tags=e2e). Pulls dxflrs/garage:v2.3.0 per Garage container.
  Runs on master and tags.

* publish.yml — tag-only. Builds linux-amd64 static binary, ships it
  two ways: as a build artifact (visible on the job page, 90-day TTL)
  and via hut pages publish to cacher.srht.bigb.es with a minimal
  index.html and embedded sha256 for verification. Uses
  oauth: pages.sr.ht/PAGES:RW so no manual secret registration needed.

Go is installed from upstream tarball in every manifest because
ubuntu/noble's golang-go is too old for the go.mod requirement
(1.26.3). hut is built from source in publish.yml since it's not
packaged for noble.

README install snippet updated to point at the pages URL.