fix: pin action version comments to exact releases to resolve ref-version-mismatch

[predictor2718]

Closes the zizmor/ref-version-mismatch code scanning alerts on ci.yml (originally #1–#6).

Cause

Three actions were pinned with a bare-major version comment:

actions/setup-go@<sha>              # v6
actions/setup-node@<sha>            # v6
golangci/golangci-lint-action@<sha> # v9

A comment like # v6 is only accurate for as long as the v6 tag happens to point at the pinned SHA. Every upstream release moves the tag, and the comment silently becomes wrong — which is what ref-version-mismatch reports.

This is self-inflicted and self-perpetuating: Dependabot preserves whatever comment style it finds. On the PRs merged just before this one it rewrote # v6 back to # v6, so bumping alone never fixes it. Where the repo already used exact comments (actions/checkout # v7.0.0, trivy-action # v0.36.0, zizmor-action # v0.5.7) no alert was ever raised.

Worth noting the recent bumps incidentally cleared four of the six alerts — the freshly bumped SHAs happen to be what v6/v9 point at right now. That is luck, not a fix; the next upstream release breaks them again.

Change

Correct the six comments to the exact release each pinned SHA actually is:

Action	SHA	Comment
actions/setup-go (×3)	924ae3a…	# v6 → # v6.5.0
actions/setup-node (×2)	48b55a0…	# v6 → # v6.4.0
golangci/golangci-lint-action	ba0d7d2…	# v9 → # v9.3.0

Each version was resolved by looking up which tag points at that exact SHA via the GitHub tags API, not inferred.

No SHA is changed — this is a comment-only diff, so there is zero behaviour change in CI. Deliberately not bumping setup-node to the current v6 here even though it is a release behind; version bumps are Dependabot's job, and keeping this diff free of behaviour changes makes it trivially reviewable.

Verification

zizmor locally, same version the CI job runs:

• before: 5 findings (3 suppressed) — 2 medium, both ref-version-mismatch on setup-node
• after: No findings to report. Good job! (3 suppressed)

Also verified mechanically that the set of 40-char SHAs is byte-identical before and after the change.