chore: align Makefile tool-version hints with CI pins

[millerjp]

Summary

CI pins goimports@v0.28.0, govulncheck@v1.1.4, benchstat@v0.0.0-20260409210113-.... The Makefile install hints tell developers @latest. Developers following the hints get a different toolchain than CI.

Scope

Replace every @latest in Makefile install hints with the same pinned version used in CI.

Acceptance criteria

1. grep -n '@latest' Makefile shows no tool install hints.
2. A developer copying-and-running a hint ends up with the same version CI uses.

Source: go-quality.