Pin CI build tooling and base image in .gitlab-ci.yml

[DeveloperDurp]

Motivation

• Prevent CI supply-chain tampering by removing mutable references: pin the Go base image by digest and use the repository-pinned templ version instead of @latest so generated artifacts are reproducible and respect go.mod.

Description

• Replaced image: golang:1.26-alpine with an immutable digest image: golang:1.26-alpine@sha256:0178a641... in .gitlab-ci.yml.
• Replaced all go install github.com/a-h/templ/cmd/templ@latest entries in the lint, test, and build jobs with go install github.com/a-h/templ/cmd/templ@v0.3.1020 to match go.mod.
• Committed the configuration change to the current branch (commit message: "Pin CI build tooling").

Testing

• Validated .gitlab-ci.yml parses with ruby -e 'require "yaml"; YAML.load_file(".gitlab-ci.yml")' which succeeded.
• Verified no remaining unpinned references with a grep check for templ@latest and mutable golang: tags which returned no matches.
• Ran git diff --check and a commit, both of which completed without reported issues.

---

Codex Task