fix: prevent goreleaser running on failed semver and remove immutable…

… release conflicts

- Fix goreleaser job condition: only run when semver succeeds with a
  version OR on direct tag pushes (remove always() which caused
  goreleaser to run even when semver failed)
- Remove release mode: append from goreleaser config to avoid
  "immutable release" errors when a release already exists
- Disable automatic SLSA workflow trigger on release creation to
  prevent race conditions with goreleaser uploads

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

fix: trigger goreleaser on tag pushes in addition to branch pushes (#54)

The semver job uses the GitHub API to create tags, which can fail due
to ghost references on fork repos. Allow goreleaser to also trigger
on direct tag pushes (tags: ["v*"]) so releases can be created by
pushing a tag manually when needed.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>