Upstream publishes no releases, so CI has nothing to curl.
- pin cmd/go-cache-plugin at 3031b5d via the go.mod tool directive
- build a static stripped binary with make build
- test the built binary: static ELF, pinned provenance, and a real
go build driven through it as a GOCACHEPROG against a stub S3
- add PR build/test/pre-commit workflows and a tag release workflow
attaching linux/amd64 and linux/arm64 to a Gitea release