ci: use gobuilder image + S3 build cache for Go steps

Go compile steps ran on vanilla golang:1.25 with no shared cache,
paying full module/build cost every run. Switch to the estate
gobuilder image (plugin binary baked in) and wire GOCACHEPROG to the
shared S3-backed cache; best-effort, degrades to misses on S3 issues.

- pre-commit, test: image -> gobuilder:0.1.2-alma9
- add GOCACHE_* env + AWS creds from org secrets
- GOCACHEPROG uses absolute /tmp/gocache cache-dir
- add backend_options.kubernetes resources + serviceAccountName

.woodpecker/pre-commit.yaml

@@ -3,7 +3,28 @@ when:
 
 steps:
   - name: pre-commit
-    image: golang:1.25
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9
     commands:
       - test -z "$(gofmt -l .)"
       - go vet ./...
+    environment:
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: "https://s3.ceph.unkin.net"
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-age-api
+      GOCACHEPROG: "go-cache-plugin --cache-dir=/tmp/gocache"
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2

.woodpecker/test.yaml

@@ -3,6 +3,27 @@ when:
 
 steps:
   - name: test
-    image: golang:1.25
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9
     commands:
       - go test -race -count=1 ./...
+    environment:
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: "https://s3.ceph.unkin.net"
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-age-api
+      GOCACHEPROG: "go-cache-plugin --cache-dir=/tmp/gocache"
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 1Gi
+            cpu: 1
+          limits:
+            memory: 4Gi
+            cpu: 2