fix: harden Go workflow templates per zizmor findings

[michaelpeterswa]

Applies zizmor --fix=all across the 5 Go workflow templates
(go_app/go_lib pull_requests/push_main, go_app_release), clearing
111 of 115 findings:

• unpinned-uses: pin every action to a commit SHA (with the resolved
  version kept as a trailing comment)
• artipacked: set persist-credentials: false on checkout steps that
  don't need to push back to the repo
• template-injection: move ${{ inputs.* }} / ${{ matrix.* }} values
  out of run: blocks and into env:, so they're passed as data instead
  of interpolated into shell commands
• ref-confusion: resolved as a side effect of pinning to a SHA
• cache-poisoning: disable setup-go's default caching in
  go_app_release.yml, where the same job publishes a Docker image

The remaining 4 (adhoc-packages, ad-hoc npm install for commitlint /
conventional-changelog tooling) don't have a clean automated fix: the
tooling installs into whatever the caller repo has checked out, so
zizmor's recommended remediation (commit a lockfile) would need to
live in every consumer repo, defeating the point of a shared
template. Pinned both packages to exact matching versions instead
(also fixes a latent bug: commitlint's cli was floating to whatever
was current at CI-run time while config-conventional was pinned to a
stale v18, an unsupported cli/config version mismatch) and suppressed
with a documented zizmor: ignore[adhoc-packages].

Also fixes 20 shellcheck SC2086 warnings (unquoted expansions)
introduced by the env: extraction above by quoting the new variables
where safe. The two *_TAGS variables are deliberately left unquoted
with an explanatory comment, since they default to/can be empty and
quoting would pass a stray "" argument to go test instead of
nothing.

Test plan

• zizmor on all 5 files: 0 findings (4 documented ignores).
• actionlint on all 5 files: only the same 10 pre-existing, unrelated shellcheck warnings that existed before this change (verified by diffing against main).
• Confirm the zizmor CI check (from Add zizmor static analysis gate for GitHub Actions workflows #78) reports clean on this PR.
• After merge, cut a new minor version tag per this repo's versioning convention (no inputs/secrets/outputs changed, only implementation hardening).

Part of #76.

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[github-actions]

🌈 zizmor findings

Found 96 finding(s) across the workflows in this PR.

Rule	Severity	Count
unpinned-uses	High	58
template-injection	High	10
artipacked	Medium	17
archived-uses	Medium	3
adhoc-packages	Low	7
template-injection	Low	1

See the zizmor job run for details, or the audit docs.