Pin actions/checkout and actions/setup-go to their full commit SHAs instead of mutable tags, per review feedback. - actions/checkout@v4 → 34e114876b0b11c390a56381ad16ebd13914f8d5 - actions/setup-go@v5 → 40f1582b2485089dde7abd97c1529aa768e1baff