golang:1.25 lacked the estate CA trust and a build cache, making every
pre-commit/test run pay full compile cost and risking TLS failures
against internal endpoints.
- switch pre-commit and test steps to the gobuilder image
- wire GOCACHEPROG to go-cache-plugin against the shared S3 cache bucket
- add backend_options resources and serviceAccountName to both steps
unkin-agent