ci(srtla_send): tag-driven releases, glibc 2.27 debs, workspace-wide checks

[datagutt]

Why

Three problems with the current CI and release setup:

• The v4.0.0 tag shipped with version = "3.0.0" in Cargo.toml. Nothing checks the tag against the crate version.
• The v4.0.1 debs are built on ubuntu-latest and need glibc 2.34, so they do not run on Ubuntu 20.04 or older.
• CI never tests or lints srtla-core, srtla-protocol or network-sim. The root is also a package, so a bare cargo test or cargo clippy covers srtla_send alone.

What changed

• ci.yml runs clippy and tests with --workspace through new cargo xlint / cargo xtest aliases. It adds codespell and an MSRV check that reads rust-version. cargo-deny's advisories check replaces cargo-audit, which reads the same RustSec database. Tools come prebuilt and builds use rust-cache.
• rust-toolchain.toml pins stable 1.97.1. Nightly is used only for rustfmt and miri. Release binaries are no longer built with nightly.
• build.yml replaces build-debian.yml. It builds the debs on every push and PR with cargo-zigbuild against glibc 2.27, using the release-lto profile. scripts/package-deb.sh refuses a binary that needs a newer glibc than the Depends line promises, and builds root-owned packages.
• release.yml runs on a vX.Y.Z tag push. It checks the tag against Cargo.toml, builds through build.yml, adds sha256sums.txt and creates a draft release. The notes are grouped from conventional commits by scripts/changelog.sh. RELEASING.md has the steps.
• Issue templates, .gitattributes with eol=lf, and the stale CHANGELOG.md removed.

How to review

Start with build.yml and scripts/package-deb.sh, then release.yml. The release workflow only runs on a tag, so its first real run is the next release. It creates a draft, so a failure there stays private.

How to release after this

Bump the version in Cargo.toml, commit, then push a vX.Y.Z tag. Publishing a release in the GitHub UI no longer builds anything.

Summary by CodeRabbit

• New Features

  • Added downloadable Debian packages for 64-bit ARM and x86 Linux, supporting glibc 2.27 and later.
  • Releases now include generated changelogs and download verification checksums.
  • Added structured forms for bug reports, feature requests, and questions.

• Documentation

  • Updated installation, build, and testing guidance, and added release instructions.

• Improvements

  • Expanded automated checks across platforms, Rust versions, and security advisories.