Standardize CI/CD workflows

[mnuck]

Standardizes CI/CD workflows across all torn Go repos.

CI (ci.yml) — new or updated in all repos:

• go mod verify + go vet ./...
• golangci-lint-action@v8 (with .golangci.yml)
• go test -race ./...
• gosec → SARIF upload
• Binary + Docker build smoke test (gates on test + security passing)

CD (cd.yml) — container repos:

• Multi-arch build + push to ghcr.io
• Trivy CRITICAL/HIGH scan with SARIF upload
• cosign image signing + verification
• Fixed: build-push-action pinned to v6, Trivy output as SARIF instead of raw JSON, COSIGN_EXPERIMENTAL removed (no longer needed)

Deploy (deploy.yml) — simplified:

• Stripped down to essential steps; removed the verbose k8s instruction comments

Other:

• ci.yml: added golangci-lint, simplified test step, fixed codeql-action/upload-sarif v4→v3
• cd.yml: build-push-action v5→v6, Trivy output as SARIF, removed COSIGN_EXPERIMENTAL
• deploy.yml: simplified