What changed

This PR adds a native Linux release path for Navaris alongside the existing container-focused workflow.

It introduces:

• tag-driven GitHub Actions releases for linux-amd64 and linux-arm64
• release tarball assembly with navarisd, navaris, navaris-mcp, and navaris-agent
• systemd packaging files for native installs
• a host installer for release tarballs
• a Firecracker runtime installer that fetches pinned upstream firecracker and jailer binaries with checksum verification
• native install documentation

Why

Navaris was planned primarily around Docker, but native server installs need a first-party packaging story.

This change makes tagged releases produce installable tarballs for Debian-style hosts using systemd, while keeping Firecracker guest kernels and rootfs images out of the main release artifacts.

Firecracker packaging model

The release artifacts now treat Firecracker in two layers:

• firecracker and jailer are installed separately from upstream pinned releases via scripts/install-firecracker-runtime.sh
• guest kernels and rootfs images remain operator-managed and are not bundled into the main Navaris release tarballs

Validation

Validated locally by:

• building release tarballs for linux-amd64 and linux-arm64
• verifying archive contents
• running the packaged native installer into a temporary prefix/config/state tree
• running the Firecracker runtime installer and verifying upstream SHA256 checksums
• shell syntax checks for the new scripts

Impact

Tagged versions can now publish GitHub release assets suitable for direct Linux server installation without Docker.