Migrate GoReleaser config off deprecated dockers/docker_manifests and brews

Context

The v0.15.2 release run (triggered from PR #99) logged these GoReleaser deprecation warnings:

• dockers and docker_manifests are being phased out and will eventually be replaced by dockers_v2, check https://goreleaser.com/deprecations#dockers for more info
• dockers and docker_manifests are being phased out and will eventually be replaced by dockers_v2, check https://goreleaser.com/deprecations#dockers for more info
• DEPRECATED: brews should not be used anymore, check https://goreleaser.com/deprecations#brews for more info

Neither has a forced-removal version yet (GoReleaser only removes deprecated options on major version bumps), so this isn't urgent, but both need real design work rather than a quick fix:

dockers/docker_manifests → dockers_v2

• Consolidates the current two-section config (dockers + docker_manifests) into a single docker buildx build step.
• Requires rewriting Dockerfile.release's COPY instruction to use $TARGETPLATFORM, since GoReleaser stages per-platform artifacts differently.
• Changes build timing: images are only built during the publish phase (goreleaser publish/continue), not during build or release --skip=publish. Need to check this doesn't break local snapshot testing (goreleaser release --snapshot).
• Docs: https://goreleaser.com/deprecations/#dockers

brews → homebrew_casks

• Not a rename — moves from Homebrew Formula to Cask, a different install paradigm for end users.
• Needs a tap_migrations.json in pavelanni/homebrew-tap so existing Formula users get redirected to the new Cask automatically.
• Since our macOS binaries aren't signed/notarized, likely needs a post-install hook to strip the quarantine attribute.
• Docs: https://goreleaser.com/deprecations/#brews

Suggested approach

Do these as their own PR (not bundled with unrelated work), test with goreleaser release --snapshot locally before tagging a real release, and verify the pavelanni/homebrew-tap cask install path end-to-end before cutting over.

Start with the GoReleaser deprecation documentation and the current GoReleaser configuration, then inspect Dockerfile.release and the existing release workflow. Test the migration with goreleaser release --snapshot, checking the changed Docker build timing and the pavelanni/homebrew-tap cask install path. Done means both deprecated configuration areas are migrated, existing Formula users are handled through tap_migrations.json, and the release paths work end to end.