fix: pin CI Go to 1.24 so gosec and golangci-lint can typecheck

- 'stable' resolves to Go 1.26 on the runner; gosec v2.21.4's
  golang.org/x/tools v0.25.0 dependency fails to compile under 1.26
  with "invalid array length -delta * delta" in tokeninternal.go
- golangci-lint v1.64.8 is shipped as a binary built with Go 1.24 and
  cannot typecheck vendor/golang.org/x/crypto/chacha20poly1305/fips140only_go1.26.go
- Pinning to 1.24 matches both tools' embedded Go version and keeps
  the module buildable

Author: bravo1goingdark

.github/workflows/go.yml

@@ -13,7 +13,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: 'stable'
+          go-version: '1.24'
           cache: true
 
       - name: Verify dependencies
@@ -48,7 +48,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: 'stable'
+          go-version: '1.24'
           cache: true
 
       - name: Lint
@@ -63,7 +63,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: 'stable'
+          go-version: '1.24'
           cache: true
 
       - name: Security scan
@@ -78,7 +78,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: 'stable'
+          go-version: '1.24'
           cache: true
 
       - name: Cross-compile check