chore(deps): update github actions and pre-commit hooks (#118)

* chore(deps): update github actions and pre-commit hooks

* chore(pre-commit): replace dnephin/pre-commit-golang with local hook

The dnephin/pre-commit-golang repository has been sunset. Replace it
with a local hook that runs golangci-lint directly using the system
language. This removes the external dependency while maintaining
identical linting behavior via .golangci.yml configuration.

* fix: golangci-lint installation

* chore: update actions, update golangci in makefile

* chore: add goenv bin to path

* chore: tweaks to lint tool installation

* chore: actually modify pr-lint action

* fix(ci): tweaks to linting, permissions

* chore(ci): align golangci-lint version to v2.7.2

* chore(ci): update github actions to latest versions

* fix(ci): add install-mode for golangci-lint v2.7.2

* fix(security): use go install for golangci-lint

.github/workflows/claude.yml

@@ -11,7 +11,8 @@ on:
   pull_request_review:
     types: [submitted]
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   claude:
@@ -46,14 +47,13 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
 
       - name: Run Claude Code
         id: claude
-        # kics-scan ignore-line
-        uses: anthropics/claude-code-action@beta
+        uses: anthropics/claude-code-action@f64219702d7454cf29fe32a74104be6ed43dc637 # v1.0.34
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}