ci: upgrade actions and reorganize workflows

[Ehco1996]

Why

PR #438 (the one that just merged) hit a CI failure on the docker-image build:

• `docker/build-push-action@v5` with `cache-from: type=gha` referenced a buildkit cache manifest whose backing blob had already been garbage-collected, so `COPY ehco .` hard-failed with `RESPONSE 404 BlobNotFound`. Run: https://github.com/Ehco1996/ehco/actions/runs/25209684082
• Same run also surfaced GitHub's Node.js 20 deprecation warnings on `actions/checkout@v4`, `actions/setup-go@v5`, `actions/upload-artifact@v4`, `actions/cache@v4`.

While fixing the immediate failure, this PR also brings the workflow set up to date and tightens the structure.

What changed

Action versions (Node 24 runtimes where applicable):

• `actions/checkout` v4 → v5
• `actions/setup-go` v5 → v6 + `cache: true` (drops the manual `actions/cache` step everywhere)
• `docker/build-push-action` v5 → v6
• `goreleaser/goreleaser-action` v5 → v6, with the goreleaser CLI pinned to `~> v1` consistently in both `release.yml` and `nightly.yml` (the `.goreleaser.yml` is still v1 schema)

File reorganization:

before	after	role
`ci.yaml`	`test.yml`	tests + lint + build on PR/push
`cd.yaml`	`docker.yml`	multi-arch docker build + manifest
`nightly.yaml`	`nightly.yml`	nightly goreleaser
`issue.yaml`	`stale.yml`	stale bot
`release.yml`	`release.yml`	unchanged path, version-bumped

All extensions normalized to `.yml`.

docker.yml structural changes:

• Dropped `workflow_run` trigger. It runs the workflow file from the default branch, so PRs can't preview workflow edits — fragile and confusing. Triggers are now plain `push: branches:[master], tags:['*']` + `workflow_dispatch`. Required-checks gating should live in branch protection rules.
• Dropped the daily schedule (`nightly.yml` already runs at 00:00 UTC; rebuilding the docker image from master daily is redundant).
• Inlined the matrix into `build-image` and removed the standalone `prepare-matrix` job.
• Fixed the cache flake: `cache-from: type=gha,scope=docker-${{ matrix.platform }},ignore-error=true` — per-platform scope so the two matrix jobs don't fight over the same cache, and `ignore-error` so a stale GHA blob no longer hard-fails `COPY`.
• Manifest creation now reads tags from `docker/metadata-action` output instead of hardcoding `:latest`, so tag-triggered runs publish `:vX.Y.Z` properly too.

Cross-cutting hygiene:

• `permissions:` blocks added everywhere with least privilege (`contents:read` on test/docker, `contents:write` on release/nightly, `issues+pull-requests:write` on stale).
• `concurrency:` block on `test.yml` cancels superseded PR runs.
• `paths:` filter on `test.yml` extended to also trigger on `Makefile` and the workflow file itself.

How to verify

• `actionlint .github/workflows/*.yml` — no workflow-level errors (only pre-existing shellcheck info on the inherited nightly script).
• After merge: a master push should kick off `docker-image` directly (no `workflow_run` lag); the build should survive a stale GHA cache; `:latest` and `:sha-XXX` should land on Docker Hub.
• Tag a release: `release.yml` runs goreleaser; `docker.yml` independently builds and publishes `:vX.Y.Z` + `:latest` via the `metadata-action` tag list.

🤖 Generated with Claude Code