[jakthom]

Upgrade Beacon to the released n2k v1.8.1 so macOS binaries build with CGO_ENABLED=0, resolving the serial-enumerator failure in the previous release build. Bump Beacon's VERSION from 1.3.4 to 1.3.5.

Keep CGO disabled in GoReleaser and Docker, and check each compiled binary's recorded build settings before it can be packaged. The shared guard rejects CGO-enabled binaries and missing build metadata. CI now builds and checks amd64 and arm64 binaries on Linux, macOS, and Windows. Document the distribution requirement in README.md and AGENTS.md; CGO remains available for race-detector testing.

Validation passed:

• GoReleaser 2.14.3 snapshot packaging produced all six binaries and archives. Every binary records n2k v1.8.1 and CGO_ENABLED=0, even with CGO_ENABLED=1 in the parent environment.
• Built both Linux Docker images, extracted their final /app/beacon binaries, and verified Beacon 1.3.5, n2k v1.8.1, the expected architecture, and CGO_ENABLED=0.
• The guard accepts CGO-disabled binaries and rejects CGO-enabled binaries, non-binaries, and empty arguments. Acceptance/rejection also passed in the Alpine builder environment.
• CGO_ENABLED=0 go test ./... -timeout 300s, go vet ./..., just lint, just secure, just release-check, actionlint, GoReleaser configuration validation, and shell syntax checks.