setup-go with go-version "1.25" resolved to 1.25.11, which govulncheck flags for GO-2026-5856 (ECH privacy leak in crypto/tls, fixed in go1.25.12). Pin the exact patch in ci-backend.yml and release.yml so the vuln scan passes and release binaries build on the fixed toolchain.