v1.4 — setup-go lint/vuln gates + bug fixes

setup-go: opt-in run-lint/run-govulncheck (golangci-lint + govulncheck), each
continue-on-error behind a final gate step so enabling both surfaces both findings
even if one fails. Fixed a wrong actions/setup-go SHA/version comment (was
claimed v7.6.0, is actually v7.0.0). setup-bun: fixed skip-install not guarding
the bun-version-file lookup (repo-ops was silently resolving a nonexistent
package.json and falling back to a floating Bun version); cut unused
extra-cache-paths/-key/-restore-key-fragment inputs (zero real callers, the
repo's only armed instance of the actions/runner#2009 nesting-cache bug).
setup-nextjs-bun: cut unused install-args input.