ci: adopt shared Go CI and security workflows

[VinnyBarton]

Summary

• replace duplicated lint, build, test, CodeQL, and OSV jobs with centrally maintained reusable workflows
• update Go from 1.25.7 to the patched 1.25.13 release
• pin reusable workflow calls to full commit SHAs
• retain PR, main-branch, scheduled, and manual security coverage

Dependency

• the security call is pinned to the permission and scanner compatibility corrections in fix: preserve CodeQL permissions across reusable calls supply-chain-workflows#10; merge that PR first

Security notes

• the caller grants only read access plus SARIF upload permission
• reusable workflow references are pinned to full commit SHAs
• govulncheck identified 16 reachable Go 1.25.7 standard-library vulnerabilities; Go 1.25.13 fixes them and the rescan reports no vulnerabilities
• the legacy OSV PR workflow fails while exporting oversized job outputs; the shared security workflow avoids that third-party reusable-workflow failure mode
• GitHub Actions validation is deferred until the remaining legacy release workflows are migrated or their existing ShellCheck findings are fixed

Verification

• shared Go lint passed
• Go formatting check passed
• go vet ./... passed
• go test -race -covermode=atomic passed with Go 1.25.13
• go build ./... passed with Go 1.25.13
• govulncheck v1.8.0 passed: no vulnerabilities found
• dependency review passed
• CodeQL passed
• workflow diff check passed

No human-review requirement is being added in this phase; all configured CI checks must pass before merge.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.