fix: vendor deps and fix CI go-version, timeout, GOTOOLCHAIN (HAN-414)

- Run go mod vendor to eliminate proxy.golang.org network dependency
- Set GOFLAGS=-mod=vendor at job env level so all go commands use vendor/
- Fix go-version from 1.23 to 1.24.0 to match go.mod
- Move GOTOOLCHAIN=local to job-level env (not per-step inline)
- Set cache: false on setup-go (cache is irrelevant with vendoring)
- Add timeout-minutes: 15 so failures are caught quickly instead of 3h

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: multica-agent <github@multica.ai>

vendor/golang.org/x/tools/internal/packagesinternal/packages.go

@@ -0,0 +1,23 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package packagesinternal exposes internal-only fields from go/packages.
+package packagesinternal
+
+import "fmt"
+
+var GetDepsErrors = func(p any) []*PackageError { return nil }
+
+type PackageError struct {
+	ImportStack []string // shortest path from package named on command line to this one
+	Pos         string   // position of error (if present, file:line:col)
+	Err         string   // the error itself
+}
+
+func (err PackageError) String() string {
+	return fmt.Sprintf("%s: %s (import stack: %s)", err.Pos, err.Err, err.ImportStack)
+}
+
+var TypecheckCgo int
+var DepsErrors int // must be set as a LoadMode to call GetDepsErrors