feat: goreleaser to manage version publishing

[OisinKyne]

Summary

The release pipeline is now goreleaser-driven, and I proved compatibility with a full local snapshot release:

• Byte-compatible with obolup.sh: assets are still raw obol__ binaries and SHA256SUMS in exactly the hash name format the installer's new checksum verifier parses — confirmed from the actual snapshot output. Ldflags verified: the built binary reports Version/Git Commit/Build Time/Dirty Repo correctly. CGO stays off (Darwin keeps the Secure-Enclave stub, same as before).
• New artifacts: .deb + .rpm for linux amd64/arm64 attached to every release (installs to /usr/bin), plus a Homebrew cask pushed to ObolNetwork/homebrew-tap. One discovery en route: goreleaser has deprecated formula-style brews entirely — casks are the supported path now. Casks get Gatekeeper-quarantined (formulas didn't), so the cask includes the goreleaser-documented xattr -dr com.apple.quarantine postflight for our unsigned binaries.
• Workflow: the verify-image-pins gate is untouched; the build-matrix + release jobs collapsed into one goreleaser job. Release stays a draft with GitHub-native generated notes, so your release-template rewrite flow is unchanged. Two safety behaviors: if HOMEBREW_TAP_GITHUB_TOKEN isn't configured, the workflow auto-passes --skip=homebrew (release still ships everything else); and skip_upload: auto means rc/prerelease tags never move what brew install resolves to. One intentional behavior change: releases are now marked prerelease automatically for rc tags (previously always prerelease: false).
• CI guard: lint-test.yaml gained a goreleaser check job so config drift fails PRs.