fix: vendor deps and fix CI go-version, timeout, GOTOOLCHAIN (HAN-414)

- Run go mod vendor to eliminate proxy.golang.org network dependency
- Set GOFLAGS=-mod=vendor at job env level so all go commands use vendor/
- Fix go-version from 1.23 to 1.24.0 to match go.mod
- Move GOTOOLCHAIN=local to job-level env (not per-step inline)
- Set cache: false on setup-go (cache is irrelevant with vendoring)
- Add timeout-minutes: 15 so failures are caught quickly instead of 3h

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: multica-agent <github@multica.ai>

vendor/golang.org/x/sys/windows/str.go

@@ -0,0 +1,22 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build windows
+
+package windows
+
+func itoa(val int) string { // do it here rather than with fmt to avoid dependency
+	if val < 0 {
+		return "-" + itoa(-val)
+	}
+	var buf [32]byte // big enough for int64
+	i := len(buf) - 1
+	for val >= 10 {
+		buf[i] = byte(val%10 + '0')
+		i--
+		val /= 10
+	}
+	buf[i] = byte(val + '0')
+	return string(buf[i:])
+}