fix(build): error on raw go build, require make build

Raw `go build` produces unsigned binaries that macOS kills. Add a
BuiltProperly ldflag that make build sets, and check it at startup.
If missing, print an error directing users to use make build.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/cmd/version.go

@@ -18,6 +18,9 @@ var (
 	// Commit and Branch - the git revision the binary was built from (optional ldflag)
 	Commit = ""
 	Branch = ""
+	// BuiltProperly is set to "1" by `make build`. If empty, the binary was built
+	// with raw `go build` and is likely unsigned (will be killed on macOS).
+	BuiltProperly = ""
 )
 
 var versionCmd = &cobra.Command{