Centralize Go CI checks and tool versions

[jakthom]

The five Go repositories already share release automation, but their test, lint, security, browser, and scheduled workflows each install their own tools. This adds a reusable check workflow and aggregate gate so callers can use one reviewed toolset while retaining their existing checks and schedules.

The shared default is Go 1.26.8. Tool versions, action commit pins, scanner execution, Bash execution, and evidence retention live here. The existing release workflow now uses the same default. CI includes a Linux/macOS/Windows smoke matrix against the reusable workflow at this commit.

Validation: actionlint passes locally. The prepared callers pass schema, trigger/job preservation, shell syntax, and aggregate failure-handling checks; repository tests and required assurance gates passed during the migration review.

This is the dependency for separate migration PRs in n2k, n2k-cli, teleop, beacon, and statemachine. Those PRs pin this exact commit so their checks can run before a v1.2.0 tag is published. Merge this policy PR before its callers; no release tag is created by this PR.

Dependent repository PRs:

• Use shared CI for tests and reliability campaigns n2k#32
• Run CLI checks with the shared CI toolset n2k-cli#6
• Use shared CI for platform and race tests teleop#9
• Use shared CI for runtime and browser gates beacon#30
• Use shared CI for assurance and fuzz workflows statemachine#10

Hosted validation: actionlint, the Linux/macOS/Windows reusable-workflow smoke matrix, and the aggregate gate all passed on this PR.