Fix multi-arch Docker manifests by upgrading GoReleaser (#22)

v1 left Buildx provenance enabled, so each architecture image was a
manifest list and docker manifest create failed. v2.20.0 disables
provenance and SBOM attestations unless they are set explicitly.

Co-authored-by: Cursor Agent <[email protected]>

.github/workflows/release.yml

@@ -47,7 +47,7 @@ jobs:
         uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5
         with:
           distribution: goreleaser
-          version: ${{ env.GITHUB_REF_NAME }}
+          version: v2.20.0
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.PUBLISHER_TOKEN }}

.goreleaser.yaml

@@ -1,3 +1,5 @@
+version: 2
+
 builds:
   - binary: cosmium
     main: ./cmd/server
@@ -30,13 +32,13 @@ brews:
 
 archives:
   - id: bundle
-    format: tar.gz
+    formats: [tar.gz]
     format_overrides:
       - goos: windows
-        format: zip
+        formats: [zip]
   - id: shared-libraries
     meta: true
-    format: "tar.gz"
+    formats: [tar.gz]
     wrap_in_directory: true
     name_template: "{{ .ProjectName }}_{{ .Version }}_shared-libraries"
     files: