feat: static binary builds and automated release script

Switch reqwest from native-tls (openssl) to rustls-tls for a pure-Rust
TLS stack, enabling fully static musl builds. Add `nix build .#static`
for portable Linux binaries and `scripts/release.sh` for automated
Gitea releases with changelog generation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Cargo.toml

@@ -13,7 +13,7 @@ lsp-types = "0.94"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 rand = "0.8"
-reqwest = { version = "0.11", features = ["blocking", "json"] }
+reqwest = { version = "0.11", default-features = false, features = ["blocking", "json", "rustls-tls"] }
 tiny_http = "0.12"
 rusqlite = { version = "0.31", features = ["bundled"] }
 postgres = "0.19"