fix(ci): unbreak CircleCI and regenerate workflows to drop Node-20 mindsers action

[weatherhog]

Unbreaks CI on this repo and regenerates the auto-generated GitHub workflow files.

1. GitHub Actions — Node 20 deprecation

Regenerates the workflows via devctl v7.40.7 gen workflows -f generic. The repo's self-contained Create Release workflow is replaced with a thin wrapper around the centralized reusable workflow in giantswarm/github-workflows, which no longer uses mindsers/changelog-reader-action (see giantswarm/github-workflows#173).

This unblocks the June 2 2026 Node 20 deprecation deadline.

Refs: giantswarm/giantswarm#36091

2. CircleCI — the build has been failing

Two separate failures, both fixed here.

Checkout (build 431) failed on the deprecated default machine image. Fixed in #12 by moving to version: 2.1 with machine.image: ubuntu-2404:current.

The architect bootstrap (builds 433, 436–438) then failed one step later. The job dated from 2019 and downloaded the architect v1.0.0 binary from the GitHub API:

wget -q $(curl -sS -H "Authorization: token $RELEASE_TOKEN" \
  https://api.github.com/repos/giantswarm/architect/releases/tags/v1.0.0 \
  | grep browser_download_url | head -n 1 | cut -d '"' -f 4)

$RELEASE_TOKEN is no longer set on this CircleCI project, so the header went out as Authorization: token and GitHub answered 401 Bad credentials. The substitution came back empty and the step died with the misleading wget: missing URL — curl -sS has no -f and there's no pipefail, so the auth error never surfaced. (The release itself is fine; it resolves even unauthenticated.)

Replaced with architect/go-test from the orb, matching giantswarm/app. The architect deploy step is dropped: it was guarded on CIRCLE_BRANCH == master while the default branch is main, so it had been dead since the rename.

3. Supporting changes

go-test has gates this repo couldn't meet, so:

• go.mod — the repo was never a Go module. This blocked go-test and broke go list -m in Makefile.gen.go.mk. go 1.24.0 sits below every consumer (they're on 1.25–1.26), so no toolchain bump is forced. Existing consumers are unaffected: v0.4.2 is immutable, so this only applies from the next tag.
• to_test.go — the package had no tests. Round-trips every exported function, 100% of statements, stdlib only so the module stays dependency-free.
• .nancy-ignore — go-test passes --exclude-vulnerability-file ./.nancy-ignore; only .nancy-ignore.generated existed, and its own header says repo-specific ignores belong in .nancy-ignore.
• CHANGELOG.md — expected by the create-release workflows, backfilled from the tag history.
• renovate.json5 — shared Giant Swarm presets.
• README — restores the CI badge lost in the 2024 deprecation churn.

Test plan

• go build, go vet, go test (100% coverage), gofmt -l, goimports -local, go mod tidy && git diff --exit-code, non-ASCII filename check — every architect/go-test gate run locally, all pass.
• Executor image architect:8.2.1 ships Go 1.26.4, above the go 1.24.0 directive.
• architect/go-test confirmed working on a repo with no pkg/project (giantswarm/app).
• CircleCI go-test goes green on this PR.
• Next release run exercises the centralized workflow path.