rpmbuild's %build shell cannot reliably access the Go toolchain or
module cache, risking a 'dev' version string. Build the binary on the
runner (where setup-go is active) with the correct -X main.version
ldflags, then package it via rpmbuild as a binary-install RPM.
Spec changes: Source0/1 are now the binary and LICENSE; %install copies
them directly; removed %prep/%build; -bb instead of -ba (no source RPM).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>