Add a release process and a first version tag for the Go module #1034

The Go module in this repository has no release process. Go users can only depend on a commit, not on a version.

The module has no version tag

The module is github.com/cipherstash/stack/languages/golang. It holds the stackauth and stackencrypt packages, which wrap two WASI guest modules built from the Rust crates. It came to this repository on 2 October 2026.

Go finds a module's versions from git tags. For a module in a subfolder, the tag must start with the folder's path, for example languages/golang/v0.1.0. No tag like that exists, so go get can only resolve a pseudo-version for a commit.

What needs deciding

1. The first version, and how the version moves. Should it follow the Rust crates, or move on its own?
2. The embedded guest modules. The packages embed WASI modules built from Rust. A release has to build those modules from the tagged commit, and check that they match the committed copies.
3. Who makes the tag. It could be a release workflow, such as release-plz or a changeset, or a person.
4. How to publish the release. For example, a GitHub release with notes, and a check that pkg.go.dev lists the version.

Done when

• There is a written release process for the Go module.
• The first version tag exists, and go get github.com/cipherstash/stack/languages/golang@<version> works.