fix(ci): pin go-version to 1.25.12 for GO-2026-5856

setup-go with go-version "1.25" resolved to 1.25.11, which govulncheck flags for
GO-2026-5856 (ECH privacy leak in crypto/tls, fixed in go1.25.12). Pin the exact
patch in ci-backend.yml and release.yml so the vuln scan passes and release
binaries build on the fixed toolchain.

.github/workflows/ci-backend.yml

@@ -42,7 +42,7 @@ jobs:
       - name: install go
         uses: actions/setup-go@v6
         with:
-          go-version: "1.25"
+          go-version: "1.25.12"
           cache-dependency-path: backend
 
       - name: test and build backend
@@ -97,7 +97,7 @@ jobs:
       - name: install go
         uses: actions/setup-go@v6
         with:
-          go-version: "1.25"
+          go-version: "1.25.12"
           # both go.sum files so the cache key covers the main and example modules scanned below
           cache-dependency-path: |
             backend/go.sum

.github/workflows/release.yml

@@ -32,7 +32,7 @@ jobs:
       - name: install go
         uses: actions/setup-go@v6
         with:
-          go-version: "1.25"
+          go-version: "1.25.12"
           cache-dependency-path: backend/go.sum
 
       - name: install pnpm
@@ -107,7 +107,7 @@ jobs:
       - name: install go
         uses: actions/setup-go@v6
         with:
-          go-version: "1.25"
+          go-version: "1.25.12"
           cache-dependency-path: backend/go.sum
 
       - name: install pnpm