H-300: wire Captain Skills into Web runtime (#48)

* H-300: wire Captain Skills into Web runtime

* H-300: enforce effective model and conservative skill budget

* H-300: fix CI gosec step

* ci: extend golangci-lint timeout

* fix lint findings across backend

* fix(push): resolve delivery protocol blockers

* test(repository): close SQLite test databases

* test(repository): reuse SQLite schema per package

* H-307: restore backend Go cache in CI

* H-307: prefetch modules before cold lint

* H-307: resolve govulncheck security gate

* H-307: build lint with patched Go toolchain

* H-307: clear remaining security scan findings

---------

Co-authored-by: Rogee <rogee@ipao.vip>

.github/workflows/ci.yml

@@ -49,13 +49,20 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.25'
+          go-version: '1.25.13'
+          cache-dependency-path: backend/go.sum
+
+      - name: Download Go modules
+        working-directory: backend
+        run: go mod download
 
       # Lint
       - name: Run golangci-lint
         uses: golangci/golangci-lint-action@v6
         with:
           version: v1.64
+          install-mode: goinstall
+          args: --timeout=5m
           working-directory: backend
 
       # Vet
@@ -110,7 +117,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.26.4'
+          go-version: '1.26.6'
           cache-dependency-path: channels/shangwutong/go.sum
       - name: Verify sqlc generation
         run: go tool sqlc generate && git diff --exit-code -- db/generated
@@ -128,14 +135,12 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.25'
+          go-version: '1.25.13'
 
       # Gosec — Go security scanner
       - name: Run gosec
-        uses: securego/gosec@master
-        with:
-          args: '-no-fail ./...'
         working-directory: backend
+        run: go run github.com/securego/gosec/v2/cmd/gosec@v2.28.0 -no-fail ./...
 
       # Dependency vulnerability scan
       - name: Run govulncheck