A step that runs `go install <tool>@<version>` and then invokes the tool fails
with exit 127: the binary lands in $GOPATH/bin, which nothing adds to PATH, and
GOPATH defaults to /root/go. Pipelines moving here from docker.io/golang, where
/go/bin is on PATH, break on that difference.
- Set GOPATH=/go and prepend /go/bin to PATH, matching the official golang images.
- Create /go/bin mode 1777 so go install also works if the image runs as non-root.
- Document the installed-tool contract in the README.