Go compile steps ran on vanilla golang:1.25 with no shared cache,
paying full module/build cost every run. Switch to the estate
gobuilder image (plugin binary baked in) and wire GOCACHEPROG to the
shared S3-backed cache; best-effort, degrades to misses on S3 issues.
- pre-commit, test: image -> gobuilder:0.1.2-alma9
- add GOCACHE_* env + AWS creds from org secrets
- GOCACHEPROG uses absolute /tmp/gocache cache-dir
- add backend_options.kubernetes resources + serviceAccountName