Harden CI and switch release builds to tagged immutable images

.gitattributes

@@ -0,0 +1,19 @@
+* text=auto eol=lf
+
+*.go text eol=lf
+*.md text eol=lf
+*.sql text eol=lf
+*.ts text eol=lf
+*.tsx text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf
+*.ps1 text eol=crlf
+
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.webp binary
+*.ico binary
+*.woff2 binary
+