feat(pre-commit-advisory): restore/seed Go caches for the golang hooks

[blairham]

Summary

• The golang hooks are diff-triggered but whole-module in execution: golangci-lint typechecks the entire module and go-mod-tidy-repo re-resolves the full module graph, and the workflow cached nothing Go-related — every PR advisory run paid ~4 minutes cold (measured on chaos-lab run 30557635862: 42s tidy + 3m27s lint, everything else <1s).
• PR runs now restore ~/go/pkg/mod, ~/.cache/go-build, and ~/.cache/golangci-lint (restore-only, so per-push ~0.5–1GB saves don't churn the repo's 10GB cache budget). ~/go/pkg/mod also covers the GOTOOLCHAIN auto-provisioned toolchain.
• The push-to-default-branch seed run now also executes the Go hooks (failures swallowed — it's a seed, not a gate) and saves the caches per-sha, so PRs restore a warm cache at most one merge behind and only re-analyze the packages they touched.
• All three new steps are gated on a go.sum existing, and the warm step tolerates missing hook ids — additive no-op for every non-Go caller.

Test plan

• actionlint passes locally on the edited workflow (done)
• actionlint CI check green on this PR
• After merge: push to a Go caller's main (e.g. chaos-lab) seeds the go-hook-caches-* cache in the advisory job
• Next PR advisory run on that repo restores the cache and the pre-commit step drops from ~4m to well under a minute

🤖 Generated with Claude Code