Pin staticcheck and deduplicate static analysis in analysis.yml

[herve-quiroz]

Split out of the June 2026 workflow audit (#10), which raised two repository-local
suggestions that do not belong in an audit thread.

1. Pin staticcheck. .github/workflows/analysis.yml:27 installs it with
go install honnef.co/go/tools/cmd/staticcheck@latest. That is non-deterministic
and inconsistent with the pinning discipline used everywhere else in the file: a
toolchain that changes underneath CI can fail a build on a commit that changed
nothing.

2. Consolidate overlapping static analysis. analysis.yml runs three tools as
separate steps:

• go vet ./... (line 30)
• staticcheck ./... (line 33)
• golangci-lint-action@v7 (line 36)

golangci-lint already bundles both govet and staticcheck as linters, so the
first two steps are largely redundant with the third. Consider enabling those
linters in the golangci-lint config and dropping the standalone steps, which also
removes the need for item 1.

Neither is urgent; CI is green.

Correction: the original audit claimed go vet runs three times in this file.
It does not, it appears once at line 30. The redundancy is across tools, not
repetitions of go vet.