ci: bump goreleaser-action v6 -> v7 (#13)

## Summary

v7's only breaking change is the Node.js runtime (20 → 24). GitHub
deprecated Node 20 for actions in Sept 2026; the v2.5.0 release run
surfaced the deprecation warning. No input/output changes — `v6` and
`v7` accept the same `version` / `args` config.

`v7` floating tag currently resolves to `v7.2.1` (same SHA), matching
the floating-major-tag style this repo already uses for
`actions/checkout@v6` and `actions/setup-go@v6`.

## Test plan

- [x] `v7` floating tag confirmed to exist on
goreleaser/goreleaser-action
- [ ] Next release tag push exercises the bumped action (only runs on
`v*` tag push, so can't validate via CI on this PR — merge then cut a
patch tag if you want to smoke-test)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk: a dependency bump in the GitHub Actions release workflow,
but it can affect tagging/release publishing behavior and only gets
exercised on release runs.
> 
> **Overview**
> The release GitHub Actions workflow now runs GoReleaser via
`goreleaser/goreleaser-action@v7` (was `@v6`) while keeping the same
`version` and `args` configuration.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
d86222e. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: abizer

.github/workflows/release.yml

@@ -50,7 +50,7 @@ jobs:
       - uses: actions/setup-go@v6
         with:
           go-version: "1.25"
-      - uses: goreleaser/goreleaser-action@v6
+      - uses: goreleaser/goreleaser-action@v7
         with:
           version: "~> v2"
           args: release --clean