chore(release): publish a Docker image, plus final review fixes

[ekalinin]

Stacked on #80. Review that one first. This is the last PR of the stack and also carries the fixes from the final whole-branch review.

What changed

Docker image. A gcr.io/distroless/static:nonroot image built by GoReleaser and pushed to ghcr.io/ekalinin/github-markdown-toc.go for linux/amd64 and linux/arm64. Authenticated with the workflow's built-in GITHUB_TOKEN, so no new repository secret. Distroless rather than bare scratch because every run calls https://api.github.com and needs a CA bundle.

Fixes from the final review of the whole stack:

• CHANGELOG.md records the whole parity effort under [Unreleased]. Its previous claim that output is "byte-identical to 2.0.1" stopped being true once multi-document runs began prefixing links.
• --insert now requires at least one file path. Combined with STDIN it used to fail with "no markers found", or, if the piped content had markers, report success about an already-deleted temp file and leave an orphan backup in TMPDIR.
• A TOC written into a document uses bare anchors even with several files. Previously --insert docs/*.md from a repo root wrote links into docs/a.md that resolved to docs/docs/a.md.
• WriteAtomic and the backup follow symlinks instead of replacing them. --insert on a symlinked README.md used to replace the link with a regular file and leave the real document untouched.
• make release-local-nodocker for validating a release without a Docker daemon.
• Smaller: the debug line no longer reports token-configured=false for a run authenticated by token.txt; the backup-collision error says it is refusing to overwrite; README corrections for the release tag, token.txt, and running the image with --user.

Compatibility

make release-local now needs a running Docker daemon, because the snapshot build includes the images. Use make release-local-nodocker when that is not available.

Validation

go test ./...
go vet ./...
go test -race ./...
go mod tidy -diff
goreleaser check
goreleaser release --snapshot --clean --skip=docker

The image build itself has not been exercised locally - no Docker daemon was available - so the first real test is the next tag push.

[ekalinin]

Force-pushed after the review. The mixed-input finding is fixed differently than the first attempt:

The previous version turned the path prefix off for the whole run when --insert was set, which broke the links of any remote document passed alongside a local one. The decision is now made per document: InsertMd asks its inner use case for a TOC rendered against an empty display path, and AbsolutePaths goes back to plain len(Files) > 1. A document that is not inserted into keeps its prefix.

Verified against the live API:

$ gh-md-toc --insert --no-backup --hide-footer local.md <raw-url>
* [Title](#title)
  * [Section one](#section-one)
* [github\-markdown\-toc](https://raw.githubusercontent.com/.../README.md#github-markdown-toc)

Also here: want.md/want3.md updated for the new "Docker" section, and the branch is rebased onto the current master and onto #82.

[codecov]

Codecov Report

❌ Patch coverage is 85.71429% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 83.64%. Comparing base (72ad795) to head (37e7a8f).

Files with missing lines	Patch %	Lines
internal/app/new.go	60.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master      #81      +/-   ##
==========================================
+ Coverage   83.61%   83.64%   +0.03%     
==========================================
  Files          35       35              
  Lines         946      954       +8     
==========================================
+ Hits          791      798       +7     
- Misses        100      101       +1     
  Partials       55       55              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.