Fix goreleaser step ordering

[erichs]

Avoid dirtying the git state by moving sbom generation after goreleaser builds.

[Copilot]

Pull request overview

This PR fixes the order of operations in the release workflow to prevent goreleaser from dirtying the git state. The issue occurred because goreleaser runs go mod tidy as a before hook, which could modify files after the SBOM was generated. By moving SBOM generation to after goreleaser completes, the workflow ensures all git state modifications happen before the SBOM is created.

Key changes:

• Moved SBOM generation from before goreleaser to after goreleaser execution
• Combined separate "Generate" and "Upload" steps into a single "Generate and Upload Source SBOM" step

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.14%. Comparing base (e5739f6) to head (d75257d).
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #47   +/-   ##
=======================================
  Coverage   87.14%   87.14%           
=======================================
  Files          46       46           
  Lines        2474     2474           
=======================================
  Hits         2156     2156           
  Misses        218      218           
  Partials      100      100           

Flag	Coverage Δ
unittests	87.14% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.