Release scaffolding: changelog, CI, and a research build for rumble

CHANGELOG.md says what 1.0.0 is. The CI workflow builds both toolchain images,
the payload and the package, runs every host test, and on a vX.Y.Z tag checks the
tag against VERSION before publishing the ELF, the package and their SHA256 sums.

`make C4F_PROBE=1` adds a poll of scePadVirtualDeviceGetRemoteSetting for every
live controller, logging the return code and only the bytes that change. That is
the one call that looks like it could carry a game's rumble and light-bar state
back to a virtual pad, and nothing is known about its buffer, so this is how to
find out on hardware. It builds to control4free-probe.elf and is never in a
release.

.github/workflows/build.yml

@@ -0,0 +1,59 @@
+name: build
+
+# Builds both toolchain images, the payload, the installable package, and runs
+# every host test. On a vX.Y.Z tag it also publishes the release.
+on:
+  push:
+    branches: [main, next]
+    tags: ['v*']
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: write   # the release step needs it; nothing else writes
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build the toolchain images
+        run: |
+          docker build -t control4free-build -f docker/Dockerfile docker
+          docker build -t control4free-launcher-build -f docker/Dockerfile.launcher docker
+
+      - name: Build the payload and the package
+        run: |
+          docker run --rm --network none -v "$PWD:/src" -w /src \
+            control4free-launcher-build bash -lc 'make && make -C launcher'
+
+      - name: Host tests
+        run: |
+          docker run --rm --network none -v "$PWD:/src" -w /src \
+            control4free-launcher-build python3 -B tests/run.py
+
+      - name: Collect what was built
+        run: |
+          version=$(cat VERSION)
+          mkdir -p artifacts
+          cp build/control4free.elf "build/Control4Free-$version.pkg" artifacts/
+          cd artifacts && sha256sum * > SHA256SUMS && cat SHA256SUMS
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: control4free
+          path: artifacts/
+          if-no-files-found: error
+
+      - name: Check the tag matches VERSION
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: |
+          test "v$(cat VERSION)" = "${GITHUB_REF#refs/tags/}" \
+            || { echo "tag ${GITHUB_REF#refs/tags/} does not match VERSION $(cat VERSION)"; exit 1; }
+
+      - name: Publish the release
+        if: startsWith(github.ref, 'refs/tags/v')
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release create "${GITHUB_REF#refs/tags/}" artifacts/* --verify-tag --notes-file CHANGELOG.md