ci: pin workflow actions for foundation gates

[KooshaPari]

Summary

Stacked workflow-only repair for BytePort PR #313, based on its current foundation head.

• Replace the corrupted setup-go SHA with the verified v6 SHA already used by the repository.
• Pin Tier-0 setup-node and golangci action references so governance integrity can evaluate them.
• Preserve application/dependency scope; this branch only changes workflow pins.

Validation

• YAML/workflow syntax and governance pin checks passed locally.
• git diff --check passed.

This is a draft pending CI rerun and review of the parent PR remaining Rust/frontend/audit gates.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[github-actions]

Legacy Tooling Scan Report

Severity	Count
Critical	0
High	0
Medium	0
Low	0

No violations detected.

This is a WARN-mode scan. Fix before strict enforcement begins.

[github-actions]

Legacy Tooling Scan Report

Severity	Count
Critical	0
High	0
Medium	0
Low	0

No violations detected.

This is a WARN-mode scan. Fix before strict enforcement begins.

[sonarqubecloud]

Quality Gate failed

Failed conditions
5.1% Duplication on New Code (required ≤ 3%)
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE