ci: harden release pipeline and pin tooling

Un-neuter grype CVE gate (was || echo, now fails on critical).
Add .grype.yaml with ignore for CVE-2026-41589 (wish SCP —
unreachable, we only import wish/bubbletea).

Pin: grype v0.114.0, git-cliff v2.13.1, govulncheck v1.1.4.
Tag `latest` only on tag push, not workflow_dispatch.
Build path ./cmd/uptop (survives a main.go split).
Add dist/ and uptop to .dockerignore.

.goreleaser.yaml

@@ -10,7 +10,7 @@ release:
     name: uptop
 
 builds:
-  - main: ./cmd/uptop/main.go
+  - main: ./cmd/uptop
     binary: uptop
     env:
       - CGO_ENABLED=1