v0.1.11

Runner-mode reusable gate and nightly workflows now install the newest Go patch in each caller's declared minor, so a stdlib security fix reaches every tool without editing its go.mod.

• tool-gate.yml and tool-nightly.yml resolve the minor from go-version-file (toolchain first, then go, including go.work, .go-version and .tool-versions) and ask actions/setup-go for the latest patch of that minor. A caller pinned at go 1.26.8 now builds and runs govulncheck with go1.26.9.
• toolchain default falls back to the go line. Prerelease toolchains such as go1.27rc1 keep the previous behaviour: setup-go reads the file directly, without check-latest.
• Image mode (ci-image-dir) is unchanged.