Fix CI on Go 1.26.7: golangci-lint-action v8 and vulncheck on 1.27.

v4 installs golangci-lint v1.64.8 (built with Go 1.24) which cannot lint a
1.26 module; v8 pulls v2.12. govulncheck@latest still fails to install on
1.26.7, so run that job on Go 1.27. Keep tests on push to main.

.gitea/workflows/test-pr.yaml

@@ -17,9 +17,9 @@ jobs:
       - run: go build ./...
       - run: go vet ./...
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v4
+        uses: golangci/golangci-lint-action@v8
         with:
-          version: latest
+          version: v2.12
           args: --timeout=5m
       - run: go test -race -v -shuffle=on -coverprofile=coverage.out -timeout=5m ./...
       - run: go tool cover -func=coverage.out | tail -10  # basic coverage report
@@ -30,6 +30,6 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.26.7'
-      - run: GOTOOLCHAIN=auto go install golang.org/x/vuln/cmd/govulncheck@latest
+          go-version: '1.27.0'
+      - run: go install golang.org/x/vuln/cmd/govulncheck@latest
       - run: govulncheck ./...