Switches pre-commit and test to the estate gobuilder image for TLS
trust to s3.ceph.unkin.net and a prebuilt go-cache-plugin, then wires
the shared S3-backed GOCACHEPROG.
- pre-commit.yaml, test.yaml: golang:1.25 -> gobuilder:0.1.2-alma9
- add GOCACHE_* / AWS_* env (org secrets) with absolute cache-dir
- set kubernetes resources + default serviceAccountName per step
- docker-build/release steps unchanged (compile inside Dockerfile)