ci: bump actions/setup-go to v6.4.0 (SHA-pinned)

actions/setup-go@v1 downloads Go from the legacy
storage.googleapis.com/golang bucket, which now returns 403 for 1.16.x
and breaks the release workflow. v6.4.0 fetches from go.dev/dl and the
actions/go-versions mirror.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: gdud

.github/workflows/release.yaml

@@ -22,7 +22,7 @@ jobs:
         run: git fetch --prune --unshallow
 
       - name: Set up Go
-        uses: actions/setup-go@v1
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: 1.16.x