fix(ci): bump golangci-lint to v2.4 + migrate buildkit-cache-dance to cache-map

[ysyneu]

Two CI fixes bundled because both block the rest of the open PRs:

1. Bump golangci-lint-action v2.1 → v2.4

• v2.1 binary built with Go 1.24, refuses configs targeting Go 1.25
• Unblocks dependabot PRs chore(deps): bump mvdan.cc/sh/v3 from 3.12.0 to 3.13.1 #28 and chore(deps): bump github.com/modelcontextprotocol/go-sdk from 1.2.0 to 1.5.0 #29 (both bump go.mod's go directive 1.24 → 1.25)

2. Migrate buildkit-cache-dance to v3 cache-map syntax

• v3 deprecated cache-source; without explicit cache-map, v3 attempts mkdir /var/cache/apk on the runner and fails with EACCES
• Docker Publish has been broken on every main commit since chore(ci): bump reproducible-containers/buildkit-cache-dance from 2.1.4 to 3.3.2 #21 landed
• New config explicitly maps the go-build-cache directory to /root/.cache/go-build inside the container, with skip-extraction tied to the cache-hit output

Test plan

• golangci-lint job passes on this branch
• Docker Publish (build) job passes on this branch
• After merge: rebase chore(deps): bump mvdan.cc/sh/v3 from 3.12.0 to 3.13.1 #28 and chore(deps): bump github.com/modelcontextprotocol/go-sdk from 1.2.0 to 1.5.0 #29, verify their lint turns green

🤖 Generated with Claude Code