Update Go toolchain to 1.27.1 and golangci-lint to v2.13.2

[makenowjust]

Close #410.

Renovate's #410 bumps the Go toolchain, but its CI fails because bin/golangci-lint is pinned to v2.11.4 (built with go1.26), which refuses to analyze a toolchain go1.27.1 module:

Error: can't load config: the Go language version (go1.26) used to build golangci-lint is lower than the targeted Go version (1.27.1)

Renovate can't fix this itself because the golangci-lint version lives inside a curl command in the Makefile. This PR updates both together, superseding #410 (Renovate should close it automatically once this merges):

• go.mod: toolchain go1.26.6 → go1.27.1

• Makefile: golangci-lint v2.11.4 → v2.13.2 (go1.27 support landed in v2.13.0)

• go.yml: use go-version-file: go.mod instead of a hard-coded go-version: "1.26", and move checkout before setup-go (required for go-version-file; also fixes the existing "Restore cache failed: go.mod not found" warning caused by the old step order). With this, future toolchain bumps only touch go.mod, so Renovate PRs no longer modify workflow files — which also keeps them clear of the zizmor changed-file checks.

• Makefile: install golangci-lint via go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.2 instead of the install.sh curl script. The script from master currently fails checksum verification for all v2.13.x releases: their checksums.txt now also lists *.tar.gz.sbom.json entries, and the script's basename grep matches the sbom line. go install is deterministic (verified via the Go module checksum database) and has no such parsing issue.

• Lint fixes: golangci-lint v2.13.2's updated modernize linter reported 4 new findings (slices.Backward for backward loops in ast/walk.go / tools/gen-ast-walk, reflect.TypeAssert in tools/parse / tools/util/poslang); applied via golangci-lint run --fix with minor cleanups. check-gen confirms generated code is unchanged.

Verified locally: make ci (check-gen, lint with v2.13.2, tests) passes on go1.27.1.