chore(ci): update to Debian 13 + Go 1.25 + FIPS support (#967)

Gromit-generated output:
- Dockerfile.distroless: Debian 13 nonroot base
- goreleaser.yml: FIPS builds with GOFIPS140=v1.0.0
- release.yml: dep-guard, Go 1.25 build env

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: buger