ci: migrate dockers/docker_manifests to dockers_v2

[sergiught]

📝 Summary

goreleaser check currently fails on our config, and has been printing this at the top of every release run:

• dockers and docker_manifests are being phased out and will eventually be
  replaced by dockers_v2
⨯ check failed  error=1 out of 1 configuration file(s) have issues

dockers_v2 builds one multi-platform image per registry rather than per-arch images plus manifests, which collapses two dockers blocks + four docker_manifests blocks into two dockers_v2 blocks — 87 lines of config down to 37.

Dockerfile.release changes alongside it: dockers_v2 stages each platform's binary under <os>/<arch>/ in the build context (makeContext in goreleaser's internal/pipe/docker/v2), not at the root, so the COPY has to be platform-aware via buildx's TARGETPLATFORM.

⚠️ Behaviour change for image consumers

The per-arch tags are no longer published. :VERSION-amd64 and :VERSION-arm64 existed only as inputs to the manifest step; dockers_v2 pushes a single multi-platform image instead. After this lands, the published tags are:

Published	Gone
ghcr.io/sergiught/openfga-cli:VERSION	…:VERSION-amd64
ghcr.io/sergiught/openfga-cli:latest	…:VERSION-arm64
same two on docker.io	same two on docker.io

docker pull of :VERSION or :latest resolves the right architecture as before, so only someone explicitly pinning an arch-suffixed tag is affected. (The -amd64/-arm64 suffixes still appear in snapshot builds — buildx can't --load a manifest, so goreleaser splits per platform there. That's snapshot-only and doesn't reach a release.)

🔍 Signing is unaffected — verified in goreleaser's source

This was the risk worth checking, since silently losing image signatures is the same failure class as the missing attestations in #114. dockers_v2 registers a new artifact type, artifact.DockerImageV2, rather than DockerManifest — but internal/pipe/sign/sign_docker.go includes it in the manifests filter:

case "manifests":
    filters = append(filters, artifact.ByTypes(
        artifact.DockerManifest,
        artifact.DockerImageV2,   // ← included
    ))

So the existing docker_signs block keeps signing the published images with no change.

🏷 Type of change

• 🐛 Bug fix (non-breaking)
• ✨ Feature (non-breaking)
• 💥 Breaking change (users must update) — only for consumers pinning arch-suffixed image tags
• ♻️ Refactor (no functional change)
• 📚 Docs only
• 🛠 Build / CI / tooling

🔗 Related issues

Second in the sequence started by #114. Next: brews → homebrew_casks, then goreleaser check in CI (still red until that lands — brews is the last remaining deprecation).

✅ How to verify

goreleaser check          # dockers warning gone; only the brews one remains
goreleaser release --snapshot --clean --skip=sbom,nfpm,aur,homebrew,sign

Verified locally with goreleaser v2.17.0:

$ docker run --rm ghcr.io/sergiught/openfga-cli:0.267.1-next-amd64 version
ofga 0.267.1-next (commit 8516686, built 2026-08-03T08:46:46Z, embedded openfga server v1.18.1)

$ docker image inspect …:0.267.1-next-arm64 --format '{{ .Architecture }} …'
arm64  license=MIT  version=0.267.1-next

$ docker run --rm --entrypoint ls …:0.267.1-next-amd64 -l /usr/share/licenses/ofga/LICENSE
-rw-r--r-- 1 root root 1070 /usr/share/licenses/ofga/LICENSE

Both registry blocks build, the arm64 image really is arm64 (so the TARGETPLATFORM COPY selects the right binary), OCI labels carry over, and the extra_files LICENSE still lands.

Not verifiable locally: signing and manifest push only happen on a real publish. The signing behaviour is argued from goreleaser's source above rather than observed — worth a cosign verify ghcr.io/sergiught/openfga-cli:VERSION after the first release on this config.

📋 Checklist

• 🧪 Tests added or updated where it makes sense — n/a, build config; verified with a real snapshot build + image run
• 📖 Docs updated — see note below
• 🏷 PR title follows Conventional Commits
• 🟢 make check passes locally — n/a, no Go code touched

If any docs reference :VERSION-amd64 style tags, they need updating — I did not audit for that in this PR.

[sergiught]

Audited for the docs caveat noted in the description: no docs, workflows, or site content reference arch-suffixed image tags (grep -rnE 'openfga-cli:[^ ]*-(amd64|arm64)' over *.md/*.mdx/*.astro/*.yml/*.yaml returns nothing outside .goreleaser.yaml itself). So no docs changes are needed alongside this.