feat: add cross-platform binary releases and restructure setup docs (#74)

Enable users to install the MCP server as a standalone binary (no Go or
Docker required) by building and publishing cross-platform binaries
alongside the existing Docker images. The README is restructured to
present all three installation methods (Go, Docker, Binary) as equal
options, with CLI examples for Claude Code, Gemini CLI, and Codex CLI.

- Add `build-binaries` job to the publish workflow producing archives
for darwin/linux/windows across amd64/arm64/386, with SHA-256 checksums
attached to each GitHub Release.
- Reorganize the README "Running the Server" section into "Server Setup"
with dedicated subsections for Go, Docker, and Binary, eliminating
duplicated JSON configs across the Quickstart and Client Configuration
sections.
- Add `claude mcp add`, `gemini mcp add`, and `codex mcp add` CLI
examples for both Go and Binary installation methods.

Author: tembleking

.github/workflows/publish.yaml

@@ -1,5 +1,5 @@
 ---
-name: Publish Docker image
+name: Publish
 
 on:
   push:
@@ -174,15 +174,74 @@ jobs:
           VERSION: ${{ needs.get-newer-version.outputs.new-version }}
         run: docker buildx imagetools inspect $REGISTRY:${VERSION}
 
+  build-binaries:
+    name: Build ${{ matrix.goos }}-${{ matrix.goarch }} binary
+    runs-on: ubuntu-latest
+    needs: [ get-newer-version ]
+    if: needs.get-newer-version.outputs.new-version != ''
+    defaults:
+      run:
+        shell: nix develop --command bash {0}
+    permissions:
+      contents: read
+    strategy:
+      matrix:
+        include:
+          - { goos: darwin, goarch: arm64, ext: tar.gz }
+          - { goos: darwin, goarch: amd64, ext: tar.gz }
+          - { goos: linux, goarch: arm64, ext: tar.gz }
+          - { goos: linux, goarch: amd64, ext: tar.gz }
+          - { goos: linux, goarch: "386", ext: tar.gz }
+          - { goos: windows, goarch: arm64, ext: zip }
+          - { goos: windows, goarch: amd64, ext: zip }
+          - { goos: windows, goarch: "386", ext: zip }
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v5
+
+      - name: Install Nix
+        # Pinned to v21 commit SHA for supply-chain safety.
+        # To update: git ls-remote https://github.com/DeterminateSystems/nix-installer-action.git <tag>
+        uses: DeterminateSystems/nix-installer-action@c5a866b6ab867e88becbed4467b93592bce69f8a # v21
+
+      - name: Enable Nix cache
+        # Pinned to v13 commit SHA for supply-chain safety.
+        # To update: git ls-remote https://github.com/DeterminateSystems/magic-nix-cache-action.git <tag>
+        uses: DeterminateSystems/magic-nix-cache-action@565684385bcd71bad329742eefe8d12f2e765b39 # v13
+        with:
+          use-flakehub: false
+
+      - name: Build and package binary
+        env:
+          VERSION: ${{ needs.get-newer-version.outputs.new-version }}
+          ARCHIVE: sysdig-mcp-server_${{ matrix.goos }}-${{ matrix.goarch }}
+          BINARY: sysdig-mcp-server${{ matrix.goos == 'windows' && '.exe' || '' }}
+        run: |
+          CGO_ENABLED=0 GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} \
+            go build -ldflags "-w -s -X main.Version=${VERSION}" -o "${BINARY}" ./cmd/server
+          if [ "${{ matrix.ext }}" = "tar.gz" ]; then
+            tar -czf "${ARCHIVE}.tar.gz" "${BINARY}"
+          else
+            zip "${ARCHIVE}.zip" "${BINARY}"
+          fi
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v5
+        with:
+          name: binary-${{ matrix.goos }}-${{ matrix.goarch }}
+          path: sysdig-mcp-server_${{ matrix.goos }}-${{ matrix.goarch }}.${{ matrix.ext }}
+          if-no-files-found: error
+          retention-days: 1
+
   release:
     name: Create release at Github
-    needs: [ get-newer-version ]
+    needs: [ get-newer-version, push_to_registry, build-binaries ]
     if: needs.get-newer-version.outputs.new-version != ''
     runs-on: ubuntu-latest
     permissions:
       contents: write # Required for release creation
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -208,10 +267,22 @@ jobs:
       - name: Generate changelog
         run: git-chglog -c .github/git-chglog/config.yml -o RELEASE_CHANGELOG.md $(git describe --tags $(git rev-list --tags --max-count=1))
 
+      - name: Download binary artifacts
+        uses: actions/download-artifact@v6
+        with:
+          path: /tmp/binaries
+          pattern: binary-*
+          merge-multiple: true
+
+      - name: Generate checksums
+        working-directory: /tmp/binaries
+        run: sha256sum * > checksums.txt
+
       - name: Create release
         uses: softprops/action-gh-release@v2
         with:
           name: ${{ needs.get-newer-version.outputs.new-version }}
           tag_name: ${{ needs.get-newer-version.outputs.new-version }}
           prerelease: false
           body_path: RELEASE_CHANGELOG.md
+          files: /tmp/binaries/*