add auto-detect upstream, install script, release workflow

- Default upstream auto-detected from system resolver (scutil/resolv.conf)
  instead of hardcoding Google 8.8.8.8. Falls back to Quad9 (9.9.9.9).
- Single scutil --dns pass for both upstream detection and forwarding rules
- Linux: reads backup resolv.conf if current only has loopback
- Service start/stop now couples DNS config (install on start, uninstall on stop)
- Install script for one-line binary install from GitHub Releases
- GitHub Actions release workflow: builds for macOS/Linux x86_64/aarch64

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

numa.toml

@@ -2,10 +2,11 @@
 bind_addr = "0.0.0.0:53"
 api_port = 5380
 
-[upstream]
-address = "8.8.8.8"
-port = 53
-timeout_ms = 3000
+# [upstream]
+# address = ""       # auto-detect from system resolver (default)
+# address = "9.9.9.9"  # or set explicitly
+# port = 53
+# timeout_ms = 3000
 
 [cache]
 max_entries = 10000