chore(ci): ignore verified gitleaks false positives

Each ignored fingerprint was verified as a false positive (contract addresses,
public Hardhat test key, Discord client IDs, placeholders, short-lived Vercel
OIDC token). See PR body for the per-finding rationale.

chore(ci): remove the dead Codecov upload step

No CODECOV_TOKEN secret exists in this repository, and codecov-action@v3
has been sunset by Codecov, so this step has never uploaded anything —
it is a silent no-op that costs CI time on every run.

Codecov for private repositories requires a token on a paid plan; for
these public forks a tokenless v3 upload goes nowhere. Removing the step
changes no test behaviour: the coverage report is still generated and
printed locally by the test run itself.

* ci: ensure goreleaser runs with the pushed tagged

This prevents unexpected behavior when two tags are on the same commit

* ci: add manual dispatch to goreleaser

This will allow us to run goreleaser for an old tag

This will allow us to run goreleaser for an old tag

This prevents unexpected behavior when two tags are on the same commit

Bullseye is no longer in LTS and Claude believes this is why goreleaser
is failing. Other changes address warnings from docker and deprecated
chown separator

Bullseye is no longer in LTS and Claude believes this is why goreleaser
is failing. Other changes address warnings from docker and deprecated
chown separator