feat(release): darwin/arm64 release workflow #147

Job	Run time
SBOM (SPDX + CycloneDX)	16s
Gitleaks (secret scan)	13s
jscpd (duplication < 3% on touched code)	14s
Semgrep (SAST)	23s
OSV-Scanner (SCA)	4s
Trivy (filesystem + container scan)	9s
	1m 19s

Provide feedback