fix(release): adopt reusable release unit

[jmgilman]

Summary

• replace the local release pipeline with the full-SHA-pinned meigma/release v0.1.17 unit
• keep GitHub Release and OCI publication while leaving optional publishers out of the template
• package the canonical GoReleaser binaries through Melange/apko and align locked release tools
• remove obsolete dry-run, local attestation, and ghd staging machinery
• fix repository ruleset updates to use the GitHub API PUT contract

Verification

• mise exec -- goreleaser check
• uv run python .github/scripts/test_configure_github_repo.py
• uv run .github/scripts/configure_github_repo.py plan --repo meigma/template-go-api
• mise exec -- moon run root:check
• mise run image-local
• docker run --rm template-go-api:dev --version
• docker run --rm template-go-api:dev openapi
• MACOS_NOTARIZE_ENABLED=false RELEASE_RPM_SIGNING_KEY_FILE= RELEASE_APK_SIGNING_KEY_FILE= mise exec -- goreleaser release --snapshot --clean --skip=sign

Publication remains disabled for the first stable-candidate rehearsal.