Fix multi-arch Docker manifests by upgrading GoReleaser (#22)

v1 left Buildx provenance enabled, so each architecture image was a
manifest list and docker manifest create failed. v2.20.0 disables
provenance and SBOM attestations unless they are set explicitly.

Co-authored-by: Cursor Agent <[email protected]>

.goreleaser.yaml

@@ -1,3 +1,5 @@
+version: 2
+
 builds:
   - binary: cosmium
     main: ./cmd/server
@@ -30,13 +32,13 @@ brews:
 
 archives:
   - id: bundle
-    format: tar.gz
+    formats: [tar.gz]
     format_overrides:
       - goos: windows
-        format: zip
+        formats: [zip]
   - id: shared-libraries
     meta: true
-    format: "tar.gz"
+    formats: [tar.gz]
     wrap_in_directory: true
     name_template: "{{ .ProjectName }}_{{ .Version }}_shared-libraries"
     files: