fix(go): restore dependency scanning and fork CI

[rksharma-owg]

The Go checks report GO-2026-5970 through x/text, and the pinned linter cannot read export data from the stable Go compiler selected by CI. The tidy and Bazel jobs also request a fork's head branch from the base repository, where that branch does not exist. The required Actions scan flags the old changed-files version, mutable action references and workflow-wide write permissions.

This change:

• Updates x/text to 0.39.0 while retaining the Go 1.25 minimum, and builds golangci-lint 2.14.0 with the selected compiler.
• Allows scanner installation to select its required compiler without changing the Go 1.25/1.26 test matrix.
• Resolves tidy and Bazel head branches in their owning repository, retaining Bazel's repository fallback for push events and the existing release-please branch, token and commit behavior.
• Pins actions in the changed workflows, replaces changed-files with the first advisory-fixed release, and confines Go write access to the tidy job that pushes release-please updates.

Validation:

• At e47c49c8d1ed312828f75e102e4406e67d2fad5b, hosted Go 1.25/1.26 builds, tests and vulnerability scans passed, along with stable-Go formatting, tidy, vet, race, lint, license and TODO checks. Bazel Java 17/21 builds and all 57 tests per job passed. The unchanged baseline reproduced the scanner and linter failures. Full source validation.
• At f79a8b193947d199e1037c30b86a90cbcfa80889, exact fork checkout, tidy, stable-Go lint, and Java 17/21 Maven pin/unchanged-lock checks passed. Same-repository release-please and actual push-event controls passed. The fixed changed-files action produced the expected Go/lint matches and unrelated-path exclusion. Workflow validation.
• The exact upstream zizmor 1.25.2 image and unmodified policy passed with zero findings; the baseline reproduced 17 findings. The workflow-validation run's sole failure is the deliberate control requesting this PR's fork branch from the base repository.
• All tracked source, test, dependency and build configuration outside the three workflow files is byte-identical between those commits. The full builds/tests above ran at e47c49c, rather than being repeated at f79a8b1.
• Local actionlint reports the same pre-existing unquoted $GITHUB_OUTPUT diagnostics on the original and candidate Go/Bazel workflows; the new checkout inputs and pins introduce no diagnostics.

Upstream workflow approval remains required; approval-held upstream checks are not reported as passed.

[gemini-code-assist]

Code Review

This pull request updates the golang.org/x/text dependency in the Go module from version v0.36.0 to v0.39.0, along with updating the corresponding checksums in go.sum. There are no review comments, so I have no feedback to provide.