Pin golangci-lint --go=1.24 to match CI image toolchain

The CI dev-environment image bundles golangci-lint v1.64.8 built with
Go 1.24, which refuses to lint code declaring "toolchain go1.25.9".
Pin the lint target to 1.24 so the existing image keeps working without
a rebuild. We don't use any 1.25 language features; the toolchain bump
only addresses CVE-2026-27143 in the Go stdlib.

Co-authored-by: Ona <no-reply@ona.com>

Author: geropl

WORKSPACE.yaml

@@ -71,5 +71,9 @@ defaultVariant:
         [
           "sh",
           "-c",
-          "golangci-lint run --disable govet,errcheck,staticcheck --allow-parallel-runners --timeout 15m",
+          # --go=1.24 keeps lint compatible with the v1.64.x golangci-lint built into the
+          # CI dev-environment image (which is itself built with Go 1.24). Our toolchain bump
+          # to 1.25.9 only addresses CVE-2026-27143 in the Go stdlib; we don't use any 1.25
+          # language features.
+          "golangci-lint run --go=1.24 --disable govet,errcheck,staticcheck --allow-parallel-runners --timeout 15m",
         ]