Fix multi-arch Docker manifests by upgrading GoReleaser (#22)

v1 left Buildx provenance enabled, so each architecture image was a
manifest list and docker manifest create failed. v2.20.0 disables
provenance and SBOM attestations unless they are set explicitly.

Co-authored-by: Cursor Agent <[email protected]>

.github/workflows/release.yml

@@ -47,7 +47,7 @@ jobs:
         uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5
         with:
           distribution: goreleaser
-          version: ${{ env.GITHUB_REF_NAME }}
+          version: v2.20.0
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.PUBLISHER_TOKEN }}