chore: prepare release 2.18.3

[cspath1]

Prepares the 2.18.3 release by hand, same approach as 2.18.2 in #622 and 2.18.1 in #620: rulesets block the release workflow from pushing version bumps straight to main, so the bump lands as a normal PR.

Re-release of 2.18.2 under correct artifact names. No code changes -- only the version constant, the changelog and the Action metadata pins.

v2.18.2 published all 15 archives named 2.18.1. The binaries were correct (verified go-toml v2.4.3 and go1.26.8 inside the published asset), but goreleaser templated the filenames from the newest tag it could see rather than the release tag, because products-for-release passes --skip-validate and suppresses the tag/HEAD check. Two consequences: the Homebrew formula, generated from the real tag, points at 2.18.2 filenames that 404, so brew install is broken; and ld-find-code-refs_2.18.1_*.tar.gz now exists on two releases with different contents. The v2.18.2 tag is immutable, so neither can be fixed in place.

When building artifacts for this release, force the version instead of letting goreleaser infer it, and check the names rather than just the count:

GORELEASER_CURRENT_TAG=v2.18.3 make products-for-release
ls -1 dist/*.tar.gz | grep -c '2.18.3' # expect 8

Then create the release as a draft with all 15 assets, verify both the count and the filenames, and only then publish.

---

Note

Overview
Prepares v2.18.3 as a metadata-only re-release of 2.18.2: bumps internal/version.Version to 2.18.3 and documents in CHANGELOG that v2.18.2 shipped correct binaries but misnamed archives (2.18.1 filenames from goreleaser/--skip-validate), which broke Homebrew URLs and collided with real 2.18.1 assets.

GitHub Action packaging is realigned to the new tag: the action Dockerfile base image, README workflow examples (@v2.18.3 and docker@v2.18.3), and docker/action.yml default/example dockerImage pins all move from 2.18.2 to 2.18.3. No application logic or dependency changes beyond the version string.

^{Reviewed by Cursor Bugbot for commit cdffded. Bugbot is set up for automated code reviews on this repo. Configure here.}