Add .goreleaser.yml for reproducible releases

[dorser]

Summary

The project uses a manual build process in the Makefile for binary compilation. GoReleaser would provide reproducible builds with checksums, SBOMs, and cross-compilation.

What's Needed

Create .goreleaser.yml with:

• Builds: Linux amd64/arm64, static binaries, CGO_ENABLED=0
• Archives: tar.gz with LICENSE and README
• Checksum: SHA256 checksums file
• SBOM: Generate SBOM (CycloneDX or SPDX)
• Changelog: Auto-generate from commits
• Docker: Optionally build Docker images

Build Requirements

The binary build requires embedded gadget tarballs in build/src/cmd/micromize/build/. GoReleaser would need a before.hooks step to prepare these, or the release workflow would need to run make build-gadgets before goreleaser release.

Files

• Makefile (current build process)
• .github/workflows/release.yml