v1.4.0 Three Go-focused components: - go-build: branch verification cross-compile (matrix of GOOS/GOARCH, version-from-ref ldflags). Skipped on tags. - go-release-binary: tag-only build, sha256 checksums, cosign keyless signing via GitLab OIDC, upload to the project's generic package registry. - release-create: tag-only GitLab Release creation with annotated tag message + asset linking from the package registry. Together these enable a full branch-and-tag CI shape for any Go project in the dunn.dev estate. First consumer: dunn.dev/bairn. Modeled on the binary + release templates in gitlab.com/gitlab-com/public-sector-tools/pipeline (Apache 2), scaled down to the dunn.dev estate's needs (no SBOM, no SLSA attestation; those layer on later if a project needs them). Existing components (claude-drift-triage, cloudflare-pages, cloudflare-r2, cloudflare-worker, container-image) ship at v1.4.0 unchanged.