ci: give the moved jobs the toolchain they assume

First real runs on this fleet turned up three things the workflows had been
getting for free from GitHub's hosted image.

golangci-lint had no setup-go step. The linter shells out to `go` to load
packages, and the job image does not carry a toolchain on PATH, so it exited on
"go command required, not found" without reading a file. It sets up Go from
go.mod now, like every other job here.

doctests ran setup-go before checkout, so go.mod was not on disk when the action
looked for it and the module cache degraded to a permanent miss. Checkout goes
first.

The e2e proxy builder was pinned to golang:1.24-alpine while go.mod requires
1.26.4. The official golang images set GOTOOLCHAIN=local, which makes the image
the authority and refuses a newer directive, so `go mod download` stopped the
compose build and took both docker.start and docker.e2e.start with it. The base
moves up to 1.26-alpine; the version stays declared in exactly one place, go.mod,
with the image as its floor.

govulncheck is reporting three standard-library advisories against this module.
That is a real finding and it stays visible.

.hanzo/workflows/doctests.yaml

@@ -30,14 +30,16 @@ jobs:
         go-version: ["1.25"]
 
     steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      # After checkout, so setup-go's module cache can key off go.mod. Ahead of
+      # it the file is not on disk yet and the cache silently degrades to a miss.
       - name: Set up ${{ matrix.go-version }}
         uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.go-version }}
 
-      - name: Checkout code
-        uses: actions/checkout@v6
-
       - name: Test doc examples
         working-directory: ./doctests
         run: make test

.hanzo/workflows/golangci-lint.yml

@@ -21,8 +21,14 @@ jobs:
     runs-on: hanzo-build-linux-amd64
     steps:
       - uses: actions/checkout@v6
+      # golangci-lint shells out to `go` to load packages, and the job image
+      # here does not ship a toolchain on PATH the way GitHub's hosted image
+      # does. Without this the linter exits on "go command required, not found"
+      # before it reads a single file.
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
       - name: golangci-lint
         uses: golangci/[email protected]
         with:
-          verify: true 
-
+          verify: true

maintnotifications/e2e/cmd/proxy-fi-server/Dockerfile

@@ -1,5 +1,5 @@
 # Build stage
-FROM golang:1.24-alpine AS builder
+FROM golang:1.26-alpine AS builder
 
 WORKDIR /build