fix(release): simplify to single-runner linux-only release #143

Job	Run time
OSV-Scanner (SCA)	5s
Trivy (filesystem + container scan)	13s
SBOM (SPDX + CycloneDX)	25s
jscpd (duplication < 3% on touched code)	16s
Semgrep (SAST)	25s
Gitleaks (secret scan)	12s
	1m 36s

Provide feedback