ci: install golangci-lint via go install (sumdb-verified)

The official install.sh tarball download hit sha256 checksum mismatches
on the self-hosted runner; the module proxy path is verifiable and
reproducible.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -44,10 +44,12 @@ jobs:
           export PATH="$PATH:$(go env GOPATH)/bin"
           make proto-gen
 
+      # Installed via `go install` (module proxy + sumdb verification): the
+      # official install.sh tarball download hit checksum mismatches on this
+      # runner.
       - name: Run golangci-lint
         run: |
-          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | \
-            sh -s -- -b "$(go env GOPATH)/bin" v2.12.2
+          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
           "$(go env GOPATH)/bin/golangci-lint" run ./...
 
   test: