build(wasm): add release-please WASM update, staleness detection, and Go CI

[aepfli]

Summary

• Move WASM binary to repo root (flagd_evaluator.wasm) as the canonical committed binary
• Add go/.gitignore to exclude local WASM copies from git tracking
• Add WASM staleness detection CI (wasm-staleness.yml) that compares SHA256 hashes on PRs touching src/ or Cargo.toml
• Update release workflow to automatically build WASM and commit it to the release-please PR branch
• Add test-go CI job that downloads the WASM artifact and runs Go tests (conditional on go/go.mod existing)
• Add infra type to release-please changelog config and PR title validation

Release flow

1. Conventional commits land on main
2. release-please opens a release PR, bumping the version in Cargo.toml
3. The update-wasm-on-release-pr job builds WASM from the version-bumped source and commits the binary into the release PR
4. Release PR merges -> tag created -> all bindings consume the versioned WASM

Staleness detection

A CI job on PRs that touch src/, Cargo.toml, or Cargo.lock rebuilds the WASM and compares the SHA256 hash to the committed binary. Warns if they differ (non-blocking since staleness during development is expected).

Go package CI

The test-go job depends on the build-wasm job. It downloads the freshly built WASM artifact into go/ and runs go test. The job is conditional on go/go.mod existing, so it will activate when the Go package from #71 is merged.

Closes #83

Test plan

• Rust tests pass (cargo test)
• Clippy + fmt clean
• Verify wasm-staleness.yml runs on PRs touching src/
• Verify test-go job is skipped (no go/go.mod yet)
• Verify release workflow update-wasm-on-release-pr job structure

🤖 Generated with Claude Code