Scaffold build repo for pinned tailscale/go-cache-plugin

Upstream publishes no releases, so CI has nothing to curl.

- pin cmd/go-cache-plugin at 3031b5d via the go.mod tool directive
- build a static stripped binary with make build
- test the built binary: static ELF, pinned provenance, and a real
  go build driven through it as a GOCACHEPROG against a stub S3
- add PR build/test/pre-commit workflows and a tag release workflow
  attaching linux/amd64 and linux/arm64 to a Gitea release

Makefile

@@ -0,0 +1,58 @@
+BINARY   := go-cache-plugin
+# Upstream has no releases; the shipped binary is built from the module version
+# pinned by the tool directive in go.mod.
+PKG      := github.com/tailscale/go-cache-plugin/cmd/go-cache-plugin
+DIST     := dist
+UPSTREAM := $(shell go list -m -f '{{.Version}}' github.com/tailscale/go-cache-plugin)
+GOFLAGS  := -ldflags="-s -w"
+OS       ?= $(shell go env GOOS)
+ARCH     ?= $(shell go env GOARCH)
+
+.PHONY: all build test lint fmt pre-commit clean upstream patch minor major _tag
+
+all: build
+
+# Static so the released binary runs on any image in the estate, Alpine included.
+build:
+	CGO_ENABLED=0 GOOS=$(OS) GOARCH=$(ARCH) go build $(GOFLAGS) -o $(DIST)/$(BINARY) $(PKG)
+
+test:
+	go test -v ./...
+
+lint:
+	golangci-lint run ./...
+
+fmt:
+	gofmt -w .
+
+pre-commit:
+	uvx pre-commit run --all-files
+
+upstream:
+	@echo $(UPSTREAM)
+
+clean:
+	rm -rf $(DIST)
+
+# Bump helpers -- reads the latest semver tag and creates the next one.
+# If no tag exists yet, starts from v0.0.0.
+_LATEST := $(shell git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$$' | head -1)
+_BASE   := $(if $(_LATEST),$(_LATEST),v0.0.0)
+_MAJ    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f1)
+_MIN    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f2)
+_PAT    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f3)
+
+patch:
+	@NEW=v$(_MAJ).$(_MIN).$(shell expr $(_PAT) + 1); \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
+
+minor:
+	@NEW=v$(_MAJ).$(shell expr $(_MIN) + 1).0; \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
+
+major:
+	@NEW=v$(shell expr $(_MAJ) + 1).0.0; \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
+
+_tag:
+	git push origin $(TAG)