Update Go workflow to supported action tags and pin staticcheck

[Copilot]

The Go workflow referenced non-existent @v7 action tags and used staticcheck@latest, which broke CI against the repository’s Go version from go.mod. This change updates the workflow to valid action versions while keeping go-version-file as the source of truth and pinning staticcheck to a compatible release.

• Workflow action version corrections

  • actions/checkout@v7 → actions/checkout@v4 (both jobs)
  • actions/setup-go@v7 → actions/setup-go@v5 (both jobs)
  • codecov/codecov-action@v7 → codecov/codecov-action@v4

• Staticcheck stability

  • Replaced floating install with a pinned version:

    - name: Staticcheck
      run: |
        go install honnef.co/go/tools/cmd/staticcheck@2026.1
        staticcheck ./...

• Go version source of truth preserved

  • Kept go-version-file: 'go.mod' unchanged in both jobs (no hardcoded go-version, no go.mod edits).