ci: add goreleaser dry run

[alan747271363-art]

Summary

• add a pull request workflow that runs GoReleaser in snapshot dry-run mode
• install cosign v4.1.1 in the dry run so release signing compatibility is exercised before tags are pushed
• skip publishing while keeping the release workflow's checkout, Go setup, cache, Syft, cosign, and GoReleaser path aligned

Closes #1920

Validation

• py -c "import yaml, pathlib; yaml.safe_load(pathlib.Path('.github/workflows/releaser-dry-run.yml').read_text()); print('YAML OK')"
• git diff --check

Note: this adds a GitHub Actions workflow, so the actual GoReleaser dry run will execute in CI.

[oliverbaehler]

@alan747271363-art does it need a token or anything?