Consolidate Go domains under the 'go' ecosystem identifier and add
dl.google.com for the toolchain zip host so GOTOOLCHAIN can fetch
go1.26.0 when the runner's Go is older. Restore permissions: read-all
with a clarifying comment (strict mode forbids write scopes; writes
go through safe-outputs). Regenerate lock files with gh-aw v0.82.13
and commit the auto-generated agentic maintenance workflow that backs
the hide-older-comments safe-output.