Add release workflow triggered on GitHub release creation

Builds an optimized release binary on the self-hosted macOS runner,
packages it as a tarball with SHA-256 checksum, and uploads both as
release assets.

Author: lukekim

.github/workflows/release.yml

@@ -0,0 +1,49 @@
+name: Release
+
+on:
+  release:
+    types: [created]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
+  CARGO_NET_GIT_FETCH_WITH_CLI: true
+
+jobs:
+  build:
+    name: Build release binary
+    # Self-hosted macOS runner required for CommonCrypto FFI
+    runs-on: spiceai-macos
+    permissions:
+      contents: write
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Rust build artifacts
+        uses: Swatinem/rust-cache@v2
+
+      - name: Build release binary
+        run: cargo build --release --locked --bin spiceio
+
+      - name: Package binary
+        run: |
+          cd target/release
+          tar czf spiceio-${{ runner.os }}-${{ runner.arch }}.tar.gz spiceio
+          shasum -a 256 spiceio-${{ runner.os }}-${{ runner.arch }}.tar.gz > spiceio-${{ runner.os }}-${{ runner.arch }}.tar.gz.sha256
+
+      - name: Upload release assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release upload "${{ github.event.release.tag_name }}" \
+            target/release/spiceio-${{ runner.os }}-${{ runner.arch }}.tar.gz \
+            target/release/spiceio-${{ runner.os }}-${{ runner.arch }}.tar.gz.sha256