ci: GoReleaser release pipeline

[stephnangue]

Tag-triggered GoReleaser release pipeline, mirroring Warden (adapted to Robin).

Stacked on #3 (ci/workflow); base retargets to main once #3 merges.

What's here

• .github/workflows/release.yml — on v* tags: reuses ci.yml (workflow_call), then logs in to GHCR and runs goreleaser/goreleaser-action@v7 (~> v2, release --clean). permissions: contents: write, packages: write.
• .goreleaser.yaml (v2) — linux+darwin × amd64+arm64 binaries (CGO_ENABLED=0) with version ldflags into internal/version; tar.gz archives + checksums.txt; conventional-commit changelog; dockers_v2 → ghcr.io/stephnangue/robin (v{version} + latest).
• deploy/Dockerfile.goreleaser — distroless-nonroot; copies the prebuilt binary (the source-build deploy/Dockerfile stays for the CI docker check).
• .dockerignore — lean build context.

Validation (local)

• actionlint clean on release.yml
• goreleaser check — config valid (goreleaser 2.14.0)
• goreleaser build --snapshot --single-target — builds, and --version shows the injected Version/Commit/Date

A vX.Y.Z tag will produce GitHub release archives + checksums and push ghcr.io/stephnangue/robin:vX.Y.Z + :latest.