Pushing a tag matching v* (or running the workflow manually with an existing tag) cross-compiles the four supported targets via `make build-all`, generates a SHA256SUMS file, and publishes a GitHub release with all binaries attached.