feat(release): attach native Linux packages

[jmgilman]

Summary

• build DEB, RPM, and APK packages for linux/amd64 and linux/arm64 with GoReleaser nFPM
• generate one SBOM per native package and include package payloads in the authoritative release artifact
• prove nFPM artifact records do not alter canonical Linux binary selection

Verification

• mise exec -- goreleaser check
• snapshot build produced six native packages, six package SBOMs, and 24 checksummed payloads; local keyless signing then stopped as expected because the laptop has no Actions OIDC identity
• installed and ran DEB, RPM, and APK packages for both amd64 and arm64 in Ubuntu 24.04, Fedora 43, and Alpine 3.22 containers
• mise exec -- go test ./internal/profile/goprof -run TestSelectBinaries -count=1
• mise exec -- moon run check
• git diff --check