fix(codeql): provision Go toolchain

[rldyourmnd]

What changed

• conditionally provisions the digest-pinned Go toolchain for the Go CodeQL matrix entry
• resolves the version from the checked-out go.mod
• disables setup-go cache writes on persistent runners
• records the action consumer in the canonical tool catalog

Why

The reusable CodeQL workflow assumed go existed in the ambient runner PATH. GDS PR #95 proved that this is false on the configured persistent runner, causing extraction to fail before analysis.

Permissions and threat model

No permissions changed. The new step runs only for the go language and uses the existing digest-pinned actions/setup-go action. Repository code remains unprivileged and checkout credentials remain disabled.

Validation

• python3 scripts/validate_all.py
• actionlint
• uvx zizmor --persona regular --min-severity low .github/workflows
• git diff --check