ci: harden Go workflows — official golangci-lint action, concurrency, path filters, single coverage pass, zenoh-c cache

[EslaM-X]

Summary

Hardens the two Go CI workflows — Run Go Lint and Run Go Unit Tests — so every change to the shared tunnel is validated faster, safer, and exactly once.

This is a pure CI/infra change: no Go, Makefile, or behavior code is touched. It mirrors the make:/config: infra-cleanup commits already merged on main.

---

Motivation

Three concrete problems existed in the current workflows:

#	Problem	Impact
1	golangci-lint was installed by piping the project's master/install.sh into a shell (curl … | sh)	Classic supply-chain footgun — the script is fetched from master; only the binary version is pinned
2	Run Go Unit Tests executed the suite twice (make test and make test-coverage); no per-function summary was ever printed; coverage was only reachable via a downloaded artifact	Wasted runner minutes on every PR and empty in-log signal
3	No concurrency, timeout-minutes, permissions, or paths filters; the zenoh-c cgo prerequisite was re-downloaded on every job; actions/cache@v3 is deprecated	Push+PR double-runs, README-only PRs triggered full Go builds, slow cold starts, and stale actions

Changes

go-lint.yml

• Install golangci-lint via the official golangci/golangci-lint-action@v6 with the version pinned to v2.7.2 (unchanged from before) — no more install.sh piping. make lint remains the single source of truth for cgo environment and lint flags.
• concurrency (cancel-in-progress), timeout-minutes: 15, permissions: contents: read, workflow_dispatch.
• paths filters: tunnel/**, Makefile, .github/workflows/**.
• Cache the pinned zenoh-c release (actions/cache@v4, keyed on OS + arch) so cgo analysis starts warm.

go-unitest.yml

• Collapsed the double test execution into a single make test-coverage pass, then go tool cover -func prints the per-function coverage summary directly in the run log.
• Same concurrency/timeout/permissions/workflow_dispatch/paths hardening and zenoh-c caching.
• Coverage artifact upload preserved unchanged (tunnel/coverage.out).

Validation

• Both YAML files parse cleanly (PyYAML safe_load).
• The exact CI command sequence was executed locally and passes:
  • go test -p 8 -coverprofile coverage.out ./... → all packages ok
  • go tool cover -func coverage.out → per-function summary printed (total 11.9%)
  • go vet ./... → clean
• Both workflows run on their own PR (paths matches .github/workflows/**), so this PR is verified by CI itself — the new definitions validate the codebase exactly as every future PR will.

Notes

• paths filters mean documentation-only PRs (README/docs) will show these checks as skipped rather than passing — expected and intended: nothing Go-related can regress.
• golangci-lint version is identical (v2.7.2); only the installation mechanism changed.

— EslaM-X 🇪🇬