ci: source the Go version from go.mod in copilot-setup-steps

[devantler]

🤖 Generated by the Daily AI Assistant

Problem

.github/workflows/copilot-setup-steps.yml hardcodes the Go toolchain:

      - name: Set up Go
        uses: actions/setup-go@… # v6.4.0
        with:
          go-version: "1.25.1"

…but go.mod declares go 1.25.10, so the Copilot setup environment runs an
older Go than the module floor. AGENTS.md is explicit that go.mod is "the
single source of truth, so it never drifts" — yet this workflow has drifted
(1.25.1 < 1.25.10), and as a template the stale pin propagates to every
scaffolded project's Copilot environment.

cd.yaml already does this correctly and documents exactly why:

          # Track the go.mod floor so the release toolchain never drifts below it
          go-version-file: go.mod

Fix

Use go-version-file: go.mod in copilot-setup-steps.yml, matching cd.yaml.
The Copilot toolchain now tracks the module floor automatically and can never
drift again. One-line change (plus a short comment).

Validation

• actionlint .github/workflows/copilot-setup-steps.yml → clean.
• go-version-file is supported by actions/setup-go v6 (already relied on in
  cd.yaml).

[github-actions]

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	6		0	0	0.31s
✅ ACTION	zizmor	6	0	0	0	1.2s
✅ COPYPASTE	jscpd	yes		no	no	0.86s
✅ EDITORCONFIG	editorconfig-checker	28		0	0	0.06s
✅ GO	golangci-lint	yes	yes	no	no	19.98s
✅ JSON	jsonlint	1		0	0	0.42s
✅ JSON	prettier	1	0	0	0	0.54s
✅ JSON	v8r	1		0	0	2.32s
✅ MARKDOWN	markdownlint	5	0	0	0	1.18s
✅ MARKDOWN	markdown-table-formatter	5	0	0	0	0.29s
✅ REPOSITORY	checkov	yes		no	no	27.18s
✅ REPOSITORY	gitleaks	yes		no	no	0.12s
✅ REPOSITORY	git_diff	yes		no	no	0.01s
✅ REPOSITORY	grype	yes		no	no	58.38s
✅ REPOSITORY	osv-scanner	yes		no	no	1.9s
✅ REPOSITORY	secretlint	yes		no	no	1.27s
✅ REPOSITORY	syft	yes		no	no	2.36s
✅ REPOSITORY	trivy	yes		no	no	11.79s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.18s
✅ REPOSITORY	trufflehog	yes		no	no	3.38s
✅ SPELL	lychee	16		0	0	0.9s
✅ YAML	prettier	10	0	0	0	0.64s
✅ YAML	v8r	10		0	0	12.68s
✅ YAML	yamllint	10		0	0	0.65s

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

[devantler]

🤖 Generated by the Daily AI Assistant

CI note (not caused by this change): the copilot-setup-steps check is red
on an upstream golangci-lint issue, unrelated to this one-line go-version
edit. The failing step is Install golangci-lint
(curl … golangci-lint/install.sh | sh -s -- latest), where the install
script's expected checksum no longer matches the actual golangci-lint v2.12.2 linux-amd64 asset:

err hash_sha256_verify checksum for 'golangci-lint-2.12.2-linux-amd64.tar.gz' did not verify
fd3a137c…  vs  8df580d2…   (expected)

The mismatch is deterministic (identical hashes across two runs), so it is
not transient CDN corruption — it's an upstream packaging/checksum problem in
the golangci-lint latest install path, and it would fail on main (or any PR
touching this workflow) regardless of this change.

The step this PR actually affects — Set up Go — succeeds with
go-version-file: go.mod. The required CI - Required Checks aggregator is
green (the required golangci-lint lint runs via the reusable validate workflow,
not this install.sh latest path).

Recommend tracking the golangci-lint install-checksum failure separately
(pin a known-good golangci-lint version in copilot-setup-steps.yml, or wait
for upstream to republish v2.12.2). This PR stands on its own.