ci(release): add semantic-release (tag + GitHub release only)

[gjed]

What

Adds semantic-release to this repackaging repo, scoped to tag + GitHub Release only — no CHANGELOG.md file, no version-bump commit. Nothing in-repo to bump: this repo repackages Envoy at its upstream-pinned pkgver.

Why

Every other active product repo in zextras/* has semantic-release wired. This one didn't.

Renovate integration

chore(deps) (Renovate's PKGBUILD pkgver bumps) triggers a patch release.

Jenkins

Added a Semantic Release stage after Upload artifacts.

Risk

Current tags (v1.32.10, v1.29.12, ...) are valid plain semver with a v prefix, matching tagFormat: "v${version}" here — clean pickup expected.

[gjed]

Heads up: tag semantics change

Today, tags on this repo track the repackaged upstream/original version (e.g. v1.32.10 matching Envoy's own release). Once semantic-release is enabled, the tag becomes a sequential semver number driven by conventional-commit history — it no longer reflects which Envoy version is packaged.

We don't have any actual consumer of the tag value itself (nothing parses it for upstream-version info) — the only real constraint is that a tag must exist per release, since the tag build is what triggers rc/release artifact publishing downstream. So this is an accepted tradeoff, not a bug: we lose the tag's descriptive meaning in exchange for automated tagging/changelog/GitHub Releases.

[M0Rf30]

Approved — the semantic-release setup itself is correct: tagFormat: v${version} matches the existing v1.32.10/v1.29.12 tags, and the release is tag + GitHub-release only, so nothing is pushed back to main.

One unrelated change to revert before merge, though: this diff also deletes the SPDX header from the top of Jenkinsfile.

-// SPDX-FileCopyrightText: 2021-2025 Zextras <https://www.zextras.com>
-//
-// SPDX-License-Identifier: AGPL-3.0-only

It looks accidental rather than intended — the other six PRs in this batch keep their headers, and nothing about adding .releaserc.json requires dropping it. It is not currently gated (this repo has no REUSE.toml/.reuse/ and the pipeline has no reuse lint stage, unlike e.g. carbonio-thirds-clamav), so CI will stay green either way — which is exactly why it would rot silently. Please restore those 3 lines.