Auto-bump release on push to main

[abienkowski]

Summary

• Auto-bump patch version on every push to main (trigger: branches: [main] instead of tags: ['v*'])
• New version job: detects latest v* tag, increments patch, creates tag + draft release
• Fix Rust toolchain: dtolnay/rust-toolchain@stable → actions-rust-lang/setup-rust-toolchain@v1 (reads rust-toolchain.toml)
• Move rust-toolchain.toml to repo root (cargo searches parent dirs, both setup actions find it)
• Remove goreleaser, handle Go build manually (consistent with Rust/TS pattern)
• Unchain release jobs: release-rust/-ts no longer depend on release-go (run in parallel after validate)
• Add concurrency: cancel-in-progress to release workflow
• Releases created as draft (user publishes manually)

Test Plan

• CI tests pass (Go 58, Rust 104, TS 80)
• Merge → verify Release workflow triggers on main push
• Verify tag is created with bumped patch version
• Verify draft release is created with artifacts, SBOMs, Docker images pushed to GHCR