ci(github): build and attach artifacts for macOS and Windows

One workflow builds both platforms and publishes what they built. macOS builds
and checks through nix on the self-hosted runner; Windows builds natively on
`windows-latest` for x86_64 and aarch64, with fmt, clippy and the tests on
x86_64. A publish job packages the executables and checksums and writes the
release notes with kokai: a `v*` tag makes a release, a scheduled or manual run
on master replaces the rolling nightly, and any other push to master makes a
draft.

There is no nix on the Windows runner, so it checks out the komorebi sources at
the revisions `flake.lock` pins.

.github/pull_request_template.md

@@ -0,0 +1,7 @@
+<!--
+  Please follow the Conventional Commits specification.
+
+  If you need to update your PR with changes from `master`, please run `git rebase master`.
+
+  By opening this PR, you confirm that you have read, understood and agree to this project's `CONTRIBUTING.md`.
+-->