ci: validate the goreleaser config on every PR

[sergiught]

📝 Summary

Both deprecations fixed in #115 and #116 reached us the same way: as warnings printed at the top of every release run, where a green job means nobody reads the log. Nothing in CI validated .goreleaser.yaml, so the only feedback loop for release config was running a release.

This runs goreleaser check on every PR. It exits non-zero on deprecated options — that is the point, and precisely the signal we were missing.

Two supporting details:

• Added as a step in the existing lint job, not a new job. Branch protection pins bare job names, so a new job would not be a required check until it is added there by hand; a step inside lint is enforced immediately.
• GORELEASER_VERSION pinned in ci.yml to match release.yml, so the config is validated against the same goreleaser that publishes it. The renovate custom manager previously matched only release.yml, so a second pin would have silently drifted — managerFilePatterns now covers both workflows, keeping them in lockstep in a single renovate PR.

⛔ Merge last — CI on this PR is red until #115 and #116 land

This PR is the last in the sequence by necessity. main still carries both deprecations, so goreleaser check fails against it:

• dockers and docker_manifests are being phased out … replaced by dockers_v2
• DEPRECATED: brews should not be used anymore
⨯ check failed  error=1 out of 1 configuration file(s) have issues

That red check is the change working as intended, not a defect. Merge order: #114 → #115 → #116 → this.

Verified locally that the premise holds — with both migrations applied, the check passes:

$ git merge ci/migrate-dockers-v2      # onto ci/migrate-homebrew-casks
$ goreleaser check
  • checking                    path=.goreleaser.yaml
  • 1 configuration file(s) validated
EXIT=0

🏷 Type of change

• 🐛 Bug fix (non-breaking)
• ✨ Feature (non-breaking)
• 💥 Breaking change (users must update)
• ♻️ Refactor (no functional change)
• 📚 Docs only
• 🛠 Build / CI / tooling

🔗 Related issues

Completes the sequence started by #114 (attestations surviving a late-publisher failure), #115 (dockers_v2), #116 (homebrew_casks).

✅ How to verify

actionlint .github/workflows/ci.yml
goreleaser check                                   # fails on main, passes with #115 + #116
python3 -c "import json;json.load(open('.github/renovate.json'))"
grep -rn "GORELEASER_VERSION: " .github/workflows/  # both pins identical

📋 Checklist

• 🧪 Tests added or updated where it makes sense — n/a, CI config; actionlint clean
• 📖 Docs updated — n/a, no user-facing behaviour change
• 🏷 PR title follows Conventional Commits
• 🟢 make check passes locally — n/a, no Go code touched