ci: modernize action and toolchain pins

[intel352]

Summary

• bump Go module/workflow defaults to Go 1.26.4 and the browser runtime image to Node 24
• pin GitHub Actions to audited SHAs with version comments
• disable setup-go built-in cache to avoid hidden older cache action paths
• use pinned setup-wfctl v0.74.6 while preserving the GoReleaser WFCTL_BIN path contract

Verification

• actionlint .github/workflows/*.yml
• GOWORK=off go mod tidy
• GOWORK=off go test ./...

[Copilot]

Pull request overview

This PR updates the project’s build/release toolchain and CI environment by bumping the Go toolchain directive, moving the browser runtime image to Node 24, and tightening GitHub Actions pinning in CI/release workflows.

Changes:

• Bump go.mod Go version directive to Go 1.26.4.
• Update the browser runtime Docker base image to node:24-bookworm-slim.
• Adjust CI/release workflows to use SHA-pinned actions, disable setup-go caching, and update the wfctl installation approach.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
go.mod	Updates the module’s Go toolchain version directive to 1.26.4.
docker/product-capture-browser/Dockerfile	Moves the runtime image base from Node 22 to Node 24 (bookworm slim).
.github/workflows/release.yml	Pins/adjusts release pipeline actions, disables setup-go cache, updates wfctl installation, and updates Docker action pins.
.github/workflows/ci.yml	Disables setup-go caching in CI while continuing to use SHA-pinned actions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.