chore: build with keyring opt-out tags; bump cli-common to v0.3.2

[rianjs]

Adopts the standard keyring opt-out build configuration
(cli-common working-with-secrets.md §1.10): GOFLAGS in Makefile and CI,
explicit flags in goreleaser builds. Excludes the 1Password backends
(onepassword-sdk-go incl. the wazero WASM runtime, connect-sdk-go incl.
the archived jaeger-client-go) and passage from the binary — 59 packages
out of the import graph. cli-common v0.3.2 brings byteness/keyring
v1.11.0, which ships the tags.

Refs open-cli-collective/cli-common#57

[monit-reviewer]

Automated PR Review

Reviewed commit: 3d98967

Summary

No issues found.

---

Completed in 28s | $0.62 | sonnet | daemon 0.2.127 | Glorfindel

Field	Value
Model	sonnet
Reviewers	hybrid-synthesis, harness-engineering:harness-architecture-reviewer, harness-engineering:harness-enforcement-reviewer, harness-engineering:harness-knowledge-reviewer
Engine	claude · sonnet
Reviewed by	pr-review-daemon · monit-pr-reviewer
Duration	28s wall · 26s compute (Reviewers: 17s · Synthesis: 8s)
Cost	$0.62 (estimated)
Tokens	152.2k in / 1.1k out
Turns	8

Per-workstream usage

Workstream	Model	In	Out	Cache read	Cache create	Cost
hybrid-synthesis	sonnet	33.1k	202	13.8k	19.3k (1h)	$0.12
harness-engineering:harness-architecture-reviewer	sonnet	39.4k	214	13.8k	25.6k (1h)	$0.16
harness-engineering:harness-enforcement-reviewer	sonnet	40.0k	470	13.8k	26.3k (1h)	$0.17
harness-engineering:harness-knowledge-reviewer	sonnet	39.7k	233	13.8k	25.9k (1h)	$0.16

_{Re-reviews only run when @monit-reviewer is re-requested as a reviewer — push as many commits as you need, then re-request when ready. PRs targeting branches other than main, master are skipped, even when @monit-reviewer is re-requested.}