ci: shared .github/actions/go-setup composite (15 call-sites)

[trilamsr]

Summary

Centralises actions/setup-go boilerplate that was copy-pasted across
8 workflows into one shared .github/actions/go-setup composite, so
dependabot SHA bumps land in one place and a stray cache: false
regression (CI wall-time hit twice before this consolidation) cannot
silently differ between callsites.

The composite is setup-go-only — GitHub requires actions/checkout
to run before any ./.github/actions/<x> path can resolve, so each
caller keeps its own checkout step (also lets the few callers that
need fetch-depth: 0 or ref: ${{ github.sha }} keep that config
without forcing every caller through the lowest common denominator —
the same shape the existing kind-cluster-setup composite follows).

Migrated (15 call-sites, 7 workflows)

Workflow	Call-sites
bench.yml	1
chaos.yml	3
chart.yml	3
ci.yml	5
codeql.yml	1
install-bench.yml	1
nccl-fr-fuzz-nightly.yml	1
Total	15

Skipped (intentional — preserves auditable inline state)

• compat-matrix.yml — explicit cache: false with multi-line
  zizmor cache-poisoning justification. Migrating would either lose
  the justification or force a cache: 'false' input plus the same
  comment, with no LoC win.
• release.yml (×2 sites) — uses
  cache: true # zizmor: ignore[cache-poisoning] inline pragma per
  setup-go step. The pragma is load-bearing for the zizmor audit and
  cannot survive an input-passthrough. Each job also pins
  ref: ${{ github.sha }} or fetch-depth: 0 on its own checkout
  for force-push protection; those stay verbatim.

Behavioral guarantees

• Same actions/checkout SHA preserved per caller (no checkout step
  changed in this PR — they were already there and stay there).
• Same actions/setup-go SHA (4a3601121dd01d1626a1e23e37211e3254c1c06c / v6.4.0).
• Same go-version-file: go.mod for every migrated caller.
• Same cache: true for every migrated caller.

LoC delta

.github/actions/go-setup/action.yml        | 58 ++++++++++++++++++++
.github/workflows/bench.yml                |  5 +--
.github/workflows/chaos.yml                | 15 ++------
.github/workflows/chart.yml                | 15 ++------
.github/workflows/ci.yml                   | 25 +++----------
.github/workflows/codeql.yml               |  5 +--
.github/workflows/install-bench.yml        |  5 +--
.github/workflows/nccl-fr-fuzz-nightly.yml |  5 +--
8 files changed, 73 insertions(+), 60 deletions(-)

Net +13 LoC, but the composite carries ~45 lines of decision-doc
(why setup-go-only, SKIP list, SHA pin rationale). Pure-mechanics
delta is -47 lines of duplicated workflow boilerplate replaced
by 13 lines of composite YAML.

Test plan

• actionlint .github/workflows/*.yml — green
• make actionlint — green
• python3 -c "import yaml; yaml.safe_load(open('.github/actions/go-setup/action.yml'))" — valid YAML
• Pre-commit: golangci-lint, go vet, go mod verify, attribute-namespace-check, deprecation-check — all green
• Pre-push hooks — green
• Wait for CI on ci.yml (5 call-sites migrated) + chart.yml (3 call-sites) + codeql.yml to confirm composite resolves on ubuntu-latest
• Verify no setup-go cache hit-rate regression (compare cache hit logs to a recent main run)

ci: shared `.github/actions/go-setup` composite consolidates the
`actions/setup-go` boilerplate across 15 call-sites in 7 workflows.
Dependabot SHA bumps now land in one place. No workflow's effective
behavior changes; `compat-matrix.yml` and `release.yml` keep their
inline zizmor cache-poisoning audit annotations.