Gate the release on vet and tests

CI only ever built and published. The 44 tests in internal/api ran on a
laptop or not at all, so a tag could publish binaries, a container image
and a Helm chart from a commit whose tests had never been run — and the
tests are the only thing holding several documented contracts in place,
including the received_at heartbeat and the alert ordering guard.

A test job now runs go vet and go test, and build, docker and chart all
depend on it. The release job is downstream of build, so a tag that fails
publishes nothing at all rather than publishing three artifacts out of
four.

chart-release.yml is deliberately left alone. It fires on charts/**
pushes and publishes the chart, which contains no Go code and only
references an image tag rather than building one, so gating it on the Go
suite would add a minute to every chart edit for no signal.

This still only runs at release time; nothing checks a push or a pull
request, so a broken commit stays green until somebody tags it.

.github/workflows/release.yml

@@ -7,7 +7,25 @@ on:
   workflow_dispatch:
 
 jobs:
+  # Gates every publishing job below. A tag that fails here publishes nothing:
+  # the binaries, the image and the chart are all downstream of it.
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Test
+        run: go test ./...
+
   build:
+    needs: test
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -44,6 +62,7 @@ jobs:
           path: terdut-${{ github.ref_name }}-${{ matrix.goos }}-${{ matrix.goarch }}
 
   docker:
+    needs: test
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -76,6 +95,7 @@ jobs:
             ghcr.io/yeniklas/terdut-server:${{ github.ref_name }}
 
   chart:
+    needs: test
     runs-on: ubuntu-latest
     permissions:
       contents: write