golang:1.25 lacked the estate CA trust and a build cache, paying full
compile cost every run and risking TLS failures against internal
endpoints.
- switch pre-commit and test steps to the gobuilder image
- wire GOCACHEPROG to go-cache-plugin against the shared S3 cache
- add backend_options resources and serviceAccountName to both steps