feat: static binary builds and automated release script

Switch reqwest from native-tls (openssl) to rustls-tls for a pure-Rust
TLS stack, enabling fully static musl builds. Add `nix build .#static`
for portable Linux binaries and `scripts/release.sh` for automated
Gitea releases with changelog generation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

flake.nix

@@ -14,6 +14,7 @@
         pkgs = import nixpkgs { inherit system overlays; };
         rustToolchain = pkgs.rust-bin.stable.latest.default.override {
           extensions = [ "rust-src" "rust-analyzer" ];
+          targets = [ "x86_64-unknown-linux-musl" ];
         };
       in
       {
@@ -22,8 +23,8 @@
             rustToolchain
             cargo-watch
             cargo-edit
-            pkg-config
-            openssl
+            # Static builds
+            pkgsStatic.stdenv.cc
             # Benchmark tools
             hyperfine
             poop
@@ -65,14 +66,43 @@
           src = ./.;
           cargoLock.lockFile = ./Cargo.lock;
 
-          nativeBuildInputs = [ pkgs.pkg-config ];
-          buildInputs = [ pkgs.openssl ];
-
           doCheck = false;
         };
 
-        # Benchmark scripts
+        packages.static = let
+          muslPkgs = import nixpkgs {
+            inherit system;
+            crossSystem = {
+              config = "x86_64-unknown-linux-musl";
+              isStatic = true;
+            };
+          };
+        in muslPkgs.rustPlatform.buildRustPackage {
+          pname = "lux";
+          version = "0.1.0";
+          src = ./.;
+          cargoLock.lockFile = ./Cargo.lock;
+
+          CARGO_BUILD_TARGET = "x86_64-unknown-linux-musl";
+          CARGO_BUILD_RUSTFLAGS = "-C target-feature=+crt-static";
+
+          doCheck = false;
+
+          postInstall = ''
+            $STRIP $out/bin/lux 2>/dev/null || true
+          '';
+        };
+
         apps = {
+          # Release automation
+          release = {
+            type = "app";
+            program = toString (pkgs.writeShellScript "lux-release" ''
+              exec ${self}/scripts/release.sh "$@"
+            '');
+          };
+
+          # Benchmark scripts
           # Run hyperfine benchmark comparison
           bench = {
             type = "app";