fix: harden Go library releases

[VinnyBarton]

Summary

• migrate .goreleaser.yaml to an explicit GoReleaser v2 configuration
• generate the dist/checksums.txt path required by the shared release workflow
• build the example CLI reproducibly with CGO disabled for supported Linux, macOS, and Windows targets
• use zip archives on Windows and tarballs elsewhere, with README and license included
• stop automatically moving the floating v2 compatibility tag
• temporarily disable govulncheck while keeping CodeQL and dependency review enabled

Root cause

GoReleaser completed and published v2.6.1, but its default checksum filename was dist/sbom-validator_2.6.1_checksums.txt. The shared workflow correctly failed because it expected the configured dist/checksums.txt manifest before creating provenance.

Govulncheck risk acceptance

The scan reports nine reachable Go 1.25.13 standard-library advisories: GO-2026-6617, GO-2026-6613, GO-2026-6612, GO-2026-6611, GO-2026-6610, GO-2026-6608, GO-2026-6607, GO-2026-6605, and GO-2026-6603. They are fixed in Go 1.26.9. Native govulncheck does not support per-advisory suppression, so this PR uses the explicit opt-out added by shiftleftcyber/supply-chain-workflows#17. The exception expires on 2026-11-08 and must be removed when Go is upgraded.

Dependency and rollout

Merge shiftleftcyber/supply-chain-workflows#17 first so v1 accepts run-govulncheck. The failed workflow already published the v2.6.1 GitHub release before its checksum verification failed. Do not overwrite that immutable release; merge this PR and create a new patch tag.

Validation

• Actionlint v1.7.11
• go test ./...
• goreleaser check
• full local GoReleaser snapshot across six targets
• confirmed dist/checksums.txt is generated and non-empty