ci: [sc-19289] bump Go matrix and golangci-lint to match go.mod toolchain

[devkoriel]

Unblocks the Dependabot security PR keeman#11 (golang.org/x/crypto 0.41.0 to 0.52.0), which is failing CI for a reason unrelated to the bump.

Problem: the CI matrix pins Go 1.21.x and golangci-lint v1.53 (2023), while go.mod declares go 1.23.0 with toolchain go1.24.6. Go therefore downloads the newer toolchain and emits export data the old lint binary cannot parse, so the lint step dies with:

could not load export data: internal error in importing "unicode" (unsupported version: 2)

followed by cascading bogus typecheck errors (undefined: ethereum, undefined: bip39, undefined: ssb). This is pre-existing CI staleness, not a regression from any dependency, and it will block every future security update in this repo until fixed.

Change:

• go-version matrix 1.21.x to 1.24.x, matching the toolchain go.mod already requires.
• golangci-lint v1.53 to v2.12.2, and the action to v9.3.0, SHA-pinned per the org external-actions policy. This repo has no .golangci.yml, so there is no v1-format config to migrate and v2 defaults apply cleanly.

Acceptance: this PR's own lint and test run goes green, then keeman#11 reruns green and can merge, clearing 7 criticals in this repo.

Note: golangci-lint v2 may surface pre-existing findings that v1.53 never evaluated. If it does, they are real and get fixed or explicitly excluded in a follow-up rather than by reverting this.

Ref: [sc-19289]

[devkoriel]

Merged with administrator privileges, authorised by Jinsoo Heo on 2026-08-11. Recording the bypass explicitly for the audit trail: branch protection on main requires one approving review, and GitHub forbids a PR author approving their own PR, so the review requirement could not be satisfied by the author. Change is CI-only (Go matrix 1.21.x to 1.24.x, golangci-lint v1.53 to v2.12.2) and was verified green on this PR before merge. Ref [sc-19289].