ci: derive Go version from go.mod in setup-go

[Aleksei Sviridkin (lexfrei)]

Pull Request

Summary

The CI Go jobs pinned actions/setup-go to go-version: "stable". When the go directive in go.mod requires a patch release newer than the latest stable Go the runner has provisioned, setup-go installs the older stable toolchain and exports GOTOOLCHAIN=local, so the build/test/lint steps fail with go.mod requires go >= X (running go Y; GOTOOLCHAIN=local). This is exactly what blocks the pending go 1.26.4 directive bump, where the runner provisions 1.26.3 as stable.

This switches the test and golangci-lint jobs to read the required version from go.mod via go-version-file, so setup-go installs precisely the toolchain the module declares and CI stays in lockstep with the go directive on every future bump.

Changes

• test and golangci-lint jobs now use go-version-file: go.mod instead of go-version: "stable" in actions/setup-go.

Testing

• Unit tests pass locally (make test)
• Linters pass locally (make lint)
• Generated docs are up to date (make docs produces no diff)
• Acceptance tests pass against a live cluster (make testacc), if applicable

make docs and testacc are not applicable: this is a CI-only change with no schema, resource, or code changes.

Documentation

• Examples added or updated under examples/ (if a resource/data source changed)
• Registry docs regenerated (make docs)
• CHANGELOG updated (if user-facing)

Not applicable: no user-facing or resource changes.

Checklist

• Commit messages follow semantic format (type(scope): description)
• No secrets or credentials in code or state
• Breaking changes documented (if any)

Additional Notes

The CodeQL job is unaffected (it uses its own Go extractor) and the markdown job has no Go step, so only the two Go jobs needed the change.