Publish Windows archives as .zip so the package can ship on winget (and Scoop) #161

Problem

winget cannot install Pass-CLI today, and it is not a manifest problem: the Windows
release artifacts are .tar.gz, and the Windows Package Manager only knows how to
extract .zip. The InstallerType enum in the manifest schema is exhaustive on this
point — there is no tar/gzip member:

msix, msi, appx, exe, zip, inno, nullsoft, wix, burn, pwa, portable

_{(schemas/JSON/manifests/v1.10.0/manifest.installer.1.10.0.json in microsoft/winget-cli)}

Release v0.20.0 ships:

pass-cli_0.20.0_windows_x86_64.tar.gz
pass-cli_0.20.0_windows_arm64.tar.gz

So no valid winget manifest can be written against the current release assets,
whatever manifests/winget/pass-cli.yaml says.

Cause

.goreleaser.yml has no format_overrides in the archives section, so every
platform gets GoReleaser's default tar.gz.

Fix

One block in .goreleaser.yml (GoReleaser v2.16.0, already pinned in
.github/workflows/release.yml, supports the plural formats key):

archives:
  - id: default
    name_template: >-
      ...
    format_overrides:
      - goos: windows
        formats: [ zip ]

The archive contents do not change — I checked
pass-cli_0.20.0_windows_x86_64.tar.gz and it holds pass-cli.exe, LICENSE,
README.md, CHANGELOG.md with no wrapper directory, which is exactly the layout
winget's NestedInstallerType: portable expects.

.zip is also the native archive format on Windows: users who download the asset
by hand today need a third-party tool to open a .tar.gz.

Two adjacent things I noticed while checking this

Not the point of this issue, but they are in the same blast radius:

1. scoop/pass-cli.json is broken for the same reason and then some. It points at
   pass-cli_$version_windows_amd64.zip, but the name_template maps amd64 to
   x86_64, so even after the fix above the asset will be named
   pass-cli_0.21.0_windows_x86_64.zip. It also still carries "version": "0.8.51"
   with v0.0.1 URLs and placeholder hashes.
2. The license is stated as MIT in the packaging metadata but the repo is
   Apache-2.0. LICENSE is the Apache License 2.0 text, and the GitHub API reports
   apache-2.0, while both scoop/pass-cli.json and manifests/winget/pass-cli.yaml
   say MIT. winget's review pipeline checks the declared license against the repo,
   so this would need to read Apache-2.0 in the submitted manifest anyway.

What I can offer

I have winget manifests ready for submission to microsoft/winget-pkgs
(multi-file format, ManifestVersion 1.10.0, zip + NestedInstallerType: portable,
x64 and arm64), validated against the official JSON schemas. They only need the real
SHA256 of the .zip assets, so I can open the winget-pkgs PR as soon as a release
carries them — as reyamira.pass-cli, unless you would rather submit under a
different PackageIdentifier or do it yourselves.

Happy to send the .goreleaser.yml change as a PR if that helps.