[ci] resolve current Go patches before using runner caches

[vt128]

Resolve Go matrix versions against the current release manifest instead of accepting an older runner cache. The 1.26.x macOS job selected cached Go 1.26.7 and failed a consumer whose go.mod requires the security patch 1.26.8.

Set setup-go check-latest: true, preserving the floor/latest matrix and all checks. Update the workflow guidance to match Go 1.27.

Validation: build, race tests (two runs), vet, gofmt, diff check; reusable workflow self-test on Linux, macOS, and Windows before consumers adopt it.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.56%. Comparing base (2e9f66b) to head (80bc93a).

Additional details and impacted files

@@           Coverage Diff           @@
##           master      #15   +/-   ##
=======================================
  Coverage   61.56%   61.56%           
=======================================
  Files           4        4           
  Lines         333      333           
=======================================
  Hits          205      205           
  Misses        119      119           
  Partials        9        9           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.