feat(release): automate image releases with GoReleaser

[fdpeiter]

🚀 What does this PR do?

Adds .goreleaser.yaml and .github/workflows/release.yml, modeled on powerhome/pac-quota-controller's GoReleaser setup, to automate what's currently a manual release step. On every version tag push (e.g. 1.4.2), this builds and pushes both the keess and keess-kubeconfig-reloader images to the internal Harbor registry (image-registry.powerapp.cloud/keess/...), and cuts a GitHub Release with auto-generated notes.

Runs on self-hosted (tracked separately: a RunnerDeployment is being added to powerhome/pac so this workflow has a runner that can reach the internal registry). Docker login uses HARBOR_USERNAME/HARBOR_PASSWORD secrets, following the same pattern as powerhome/oncall-notifier's release workflow.

🔍 Why? (Context)

Today, publishing the keess and kubeconfig-reloader images is a manual step (make powerhome-build-and-publish) and Jenkins only builds the main keess image to the internal registry, never kubeconfig-reloader. This closes that gap and removes the manual publish step from the release checklist going forward.

Checklist

• Update the Helm chart version and/or appVersion if those are changed
• Update cmd/version.go if code was changed
• Publish the new keess image
• Publish the new kubeconfig-reloader image
• Updated docs/ or /README.md if needed

🧪 How this was tested? And test results

• goreleaser check — config validates (only a non-blocking deprecation notice about dockers → dockers_v2, same as used by pac-quota-controller/oncall-notifier today).
• goreleaser release --snapshot --clean --skip=publish,validate locally — both Dockerfiles build successfully through GoReleaser's buildx path. The push step itself was not exercised locally (no Harbor credentials on this machine) — will be validated on the first real tag push once the HARBOR_USERNAME/HARBOR_PASSWORD secrets and the self-hosted runner are in place.

⚠️ Special care or coordination needed?

This workflow won't run successfully until:

1. powerhome/pac has a RunnerDeployment for keess (companion change, in progress)
2. HARBOR_USERNAME/HARBOR_PASSWORD repo secrets are added to powerhome/keess

Until then this is inert (no tags pushed yet), so safe to merge ahead of those.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 24 hours if no further activity occurs.
If this change is desirable, please accelerate completing it. If it is not, please close the PR. If you're blocked on something, please ensure there's a reference to this PR in a story on your team's board so the team will follow up, and consider closing the PR for now.
Please do not artificially extend the deadline with a dummy comment. If necessary, provide a status update, such as "this change is being actively tested".
Thank you for your contributions and your collaboration in reducing WIP and cycle time.