build: remove unused GoReleaser tool dependency (#2636)

## Summary

Remove the obsolete GoReleaser v1 tool declaration from the root Go
module,
along with its broken Make target and exclusively transitive
dependencies.

The GitHub release workflow already downloads a standalone current
GoReleaser
v2 binary through `goreleaser-action`. The documented local workflow
also uses
an externally installed `goreleaser` executable, so the pinned v1.26.2
module
was not used by either path.

Removing the unused graph eliminates `github.com/go-git/go-git/v5` and
addresses:

| Advisory | Severity | Before | Fixed |
| --- | --- | --- | --- |
| CVE-2026-71556 | High | go-git 5.19.1 | Dependency removed |
| CVE-2026-71557 | Medium | go-git 5.19.1 | Dependency removed |

This also removes approximately 190 unused indirect module requirements
and 568 obsolete checksum entries. It does not change Retina runtime
binaries or published images.

## Changes

- Remove the GoReleaser v1 declaration from the root `tool` block.
- Remove the nonfunctional `make goreleaser` target.
- Remove the obsolete GoReleaser-specific `go-shellwords` replacement.
- Regenerate `go.mod` and `go.sum` without the unused release-tool
graph.
- Clarify that local CLI release builds require an installed GoReleaser
v2.

## Vulnerability validation

Scanned the repository before and after the update with Trivy 0.69.3:

```bash
trivy fs --ignore-unfixed --scanners vuln --skip-dirs artifacts .
```

Before:

```text
go.mod  CVE-2026-71556  github.com/go-git/go-git/v5  v5.19.1  5.19.2  HIGH
go.mod  CVE-2026-71557  github.com/go-git/go-git/v5  v5.19.1  5.19.2  MEDIUM
```

After:

```text
github.com/go-git/go-git/v5 module: absent
github.com/go-git/go-git/v5 findings: 0
```

## Validation

```bash
go mod why -m github.com/go-git/go-git/v5
go mod verify
go test ./cli/...
go list -deps -test ./...
go run github.com/goreleaser/goreleaser/v2@v2.17.1 check
MCR_AGENT_IMAGE_NAME=mcr.microsoft.com/containernetworking/retina-agent \
  go run github.com/goreleaser/goreleaser/v2@v2.17.1 \
  build --snapshot --clean
```

The module graph verifies, all root packages resolve, and CLI tests
pass. GoReleaser v2 accepts the configuration and builds all 12
configured binaries.


## Checklist

- [ ] I have read the [contributing
documentation](https://retina.sh/docs/Contributing/overview).
- [ ] I signed and signed-off the commits (`git commit -S -s ...`). See
[this
documentation](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification)
on signing commits.
- [ ] I have correctly attributed the author(s) of the code.
- [ ] I have tested the changes locally.
- [ ] I have followed the project's style guidelines.
- [ ] I have updated the documentation, if necessary.
- [ ] I have added tests, if applicable.

## Screenshots (if applicable) or Testing Completed

Please add any relevant screenshots or GIFs to showcase the changes
made.

## Additional Notes

Add any additional notes or context about the pull request here.

---

Please refer to the [CONTRIBUTING.md](../CONTRIBUTING.md) file for more
information on how to contribute to this project.

Signed-off-by: Alex Castilio dos Santos <alexsantos@microsoft.com>

Author: alexcastilio

Makefile

@@ -96,7 +96,6 @@ help: ## Display this help
 
 GOFUMPT			= go tool mvdan.cc/gofumpt
 GOLANGCI_LINT	= go tool github.com/golangci/golangci-lint/v2/cmd/golangci-lint
-GORELEASER		= go tool github.com/goreleaser/goreleaser
 CONTROLLER_GEN	= go tool sigs.k8s.io/controller-tools/cmd/controller-gen
 GINKGO			= go tool github.com/onsi/ginkgo
 MOCKGEN			= go tool go.uber.org/mock/mockgen
@@ -106,8 +105,6 @@ gofumpt: $(GOFUMPT) ## Build gofumpt
 
 golangci-lint: $(GOLANGCI_LINT) ## Build golangci-lint
 
-goreleaser: $(GORELEASER) ## Build goreleaser
-
 controller-gen: $(CONTROLLER_GEN) ## Build controller-gen
 
 ginkgo: $(GINKGO) ## Build ginkgo