Migrate .goreleaser.yaml from deprecated brews to homebrew_casks

Problem

.goreleaser.yaml's brews: block is deprecated as of goreleaser v2.10 (soft)
and v2.16 (current — the version pinned in release.yml). goreleaser check
fails on it; goreleaser release still works today but emits a deprecation
warning, and the field will eventually be removed.

From goreleaser's own deprecation notice:

Historically, GoReleaser would generate hackyish formulas that would install
the pre-compiled binaries. This was the only way to do it for Linuxbrew at
the time, but this is no longer true, and Casks should be used instead.

Proposed fix — not a trivial rename

The literal migration is brews: → homebrew_casks: (with directory: Casks
instead of Formula). But this is a real behavior change, not just a renamed
key:

• Casks change the end-user install command from brew install stacklok/tap/modelith to brew install --cask stacklok/tap/modelith.
• Homebrew Casks have historically been a macOS-oriented mechanism. Our
  current Formula explicitly ships an on_linux do block (Linuxbrew support).
  Before migrating, confirm homebrew_casks actually preserves Linux install
  support — if it doesn't, this migration would silently drop Homebrew-based
  Linux installs.
• Neither stacklok/toolhive nor stacklok/frizbee have migrated off brews
  yet either, so there's no in-house precedent to copy from.

Context / priority

Not urgent — brews still functions correctly today (verified via a snapshot
release dry run and the actual v0.4.0 release). Worth doing before goreleaser
actually removes the field, and worth checking in on Linux-cask support first.

Start with .goreleaser.yaml and release.yml, then verify whether GoReleaser v2.16 homebrew_casks preserves the existing Linux install support. Run goreleaser check and a release dry run before and after the migration; done means the deprecated brews block is removed without dropping supported Linux installs.