A packaging release. No change to scanning, scoring, the agent, the server or
the knowledge base since v0.1.0 — the point of the tag is that the GitHub
Action's release-install path resolves for the first time.

The Action installs from a release again

v0.1.0 published its archives as upgradescope-v0.1.0-<os>-<arch>.tar.gz,
while action/action.yml fetched upgradescope_<os>_<arch>.tar.gz. Every run
404'd and fell through to the go install fallback, so the gate worked but
built from source each time and never once took the route the README describes.

402206f fixed both sides — the archive name drops the version so
/releases/latest/download/<asset> resolves to a stable filename, and the
Action extracts the binary from the tarball — but that landed six weeks after
v0.1.0, and the Action resolves assets against the release, not against
main. Until this tag there was no release carrying the corrected names.

This release publishes:

upgradescope_linux_amd64.tar.gz
upgradescope_linux_arm64.tar.gz
upgradescope_darwin_amd64.tar.gz
upgradescope_darwin_arm64.tar.gz
checksums.txt

which is exactly what the Action requests. The go install fallback stays for
platforms with no published archive.

Also in this tag

• The README's headline question targeted Kubernetes 1.38 while the embedded
  knowledge base tops out at 1.36 (maxKnownK8s, generated from k8s.io/api
  v0.36.1 — and 1.36 is the newest minor upstream has actually released). The
  flagship command's only finding was therefore a kb-stale warning about the
  tool's own knowledge base. The examples now target the horizon, and the
  horizon is documented: scanning above it is still supported, and the
  kb-stale warning is the honest answer when you do.
• staticcheck is pinned to v0.7.0 in both CI and make lint instead of
  @latest, so an upstream linter release can no longer turn an unrelated pull
  request red. make lint also no longer defers to whatever staticcheck
  happens to be on PATH.
• The Go Report Card badge is gone — goreportcard.com retired the service and
  the badge rendered "go report: retired".

Verifying

sha256sum -c checksums.txt --ignore-missing