ci: publish homebrew formula via SSH deploy key

[c4po]

Why

After v2.1.0/v2.1.1/v2.1.2, when branch protection on `main` requires verified signatures and PR review, goreleaser's default Contents API push is blocked because:

• The actor making the API call is the built-in `github-actions[bot]`, which Rulesets do not list as a selectable bypass actor.
• API commits via the default `GITHUB_TOKEN` are not GPG-verified.

Deploy keys, by contrast, are a selectable Rulesets bypass actor type and authenticate over SSH/git.

What this changes

• `.goreleaser.yaml`: under `brews[].repository`, configure `git.url` (SSH) + `git.private_key` from `${{ .Env.RELEASE_DEPLOY_KEY }}`. Pin `branch: main`. Also adds `commit_msg_template: "chore: regenerate homebrew formula"` to preserve the existing commit-message style.
• `.github/workflows/release.yaml`: pass `RELEASE_DEPLOY_KEY` from repo secrets to the goreleaser step's environment.

Setup checklist (must be done before this lands or the next release will fail)

• Add the public key as a Deploy key under Settings → Deploy keys, with "Allow write access" checked.
• Add the matching private key as a repo secret named `RELEASE_DEPLOY_KEY`.
• In the Ruleset's bypass list, add Deploy keys as a bypass actor.

Test plan

• Once merged, cut a small patch tag (e.g. v2.1.3) to validate the end-to-end flow with the new deploy-key path before re-enabling protection rules.