ci: upgrade actions/setup-go v6 -> v7 via ratchet

[cursor]

Summary

Weekly GitHub Actions ratchet review. The routine within-major bump (mise run //:ratchet:update) produced no diff this cycle — every pinned action is already at the newest release within its constrained major (checkout v7.0.1, mise-action v4.2.4, configure-aws-credentials v6.2.3, amazon-ecr-login v2.1.6, metadata-action v6.2.0, setup-qemu/buildx v4.2.0, build-push v7.3.0, upload-artifact v7.0.1, create-github-app-token v3.2.0).

The only actual update available is a new major for actions/setup-go (v6 → v7), so this PR performs that scoped upgrade (only docker.yml uses setup-go).

What changes

Action	File	Before	After	Kind
actions/setup-go	.github/workflows/docker.yml	924ae3a (# ratchet:...@v6)	b7ad1da (# ratchet:...@v7)	major v6 → v7

No other refs changed. The ratchet:upgrade was scoped to docker.yml so the other pins there (already at their newest major) were left untouched.

Risk assessment (based on changelog)

Overall risk: Low.

actions/setup-go v7.0.0 release notes — two changes:

• Migrate to ESM and upgrade dependencies (#763) — internal build/packaging change; no change to the action's inputs, outputs, or behavior.
• Bump @actions/cache to 6.2.0 (#771) — dependency update to the Go module caching backend.

Key findings:

• Runtime unchanged: action.yml runs.using is node24 on both v6 and v7. The usual major-bump breaking risk (a node20 → node24 runtime jump) does not apply here.
• No input/output changes: the go-version: "1.26.0" input we use is unaffected; no inputs were removed or renamed.
• Blast radius is limited: setup-go is only used in the docker.yml build job; a regression would surface immediately as a failed Go build in that workflow and would not push anything (push is gated on main).
• Reversible: pinned by SHA with a ratchet constraint comment; trivially revertable.

Residual risk: the @actions/cache bump could theoretically alter cache hit/restore behavior, but a cache miss only slows a build, it doesn't break correctness.

Verification checklist

• mise run //:ratchet:update → no diff (confirms all within-major pins current)
• mise run //:ratchet:upgrade .github/workflows/docker.yml → single-line change, setup-go only
• New SHA b7ad1dad31e06c5925ef5d2fc7ad053ef454303e independently resolved from actions/setup-go tag v7.0.0
• Compared action.yml runs.using on v6 vs v7 → both node24 (no runtime change)
• mise run //:ratchet:lint → passes
• mise run //:ratchet:pin → idempotent (no additional diff → CI "Verify pinning leaves no diff" will pass)
• CI green on this PR (Go / lint / ratchet / docker build) — all 3 PR checks passed pre-merge (test, lint, Ratchet Lint). Post-merge on main (d51f3a39): Go success, Ratchet success, Docker Build success (run 31388778776).
• Confirm Docker Build job's Go build step succeeds with setup-go v7 — verified at step level in the post-merge docker.yml run (enclave job, head_sha d51f3a39): step 3 Run actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e → success, and step 6 go build bin/tee-arbiter-enclave → success. Reviewer also independently re-resolved the pin: actions/setup-go tag v7 → commit b7ad1dad31e06c5925ef5d2fc7ad053ef454303e, an exact match.