ci: restrict GitHub Actions cache access with cache-mode

[nozaq]

Summary

GitHub now lets a workflow or job declare the cache access it needs with cache-mode (read, write, write-only, none), enforced by the cache service (changelog, workflow syntax, dependency caching reference). Without it, push, schedule and workflow_dispatch runs get write by default.

This applies the same least-privilege pattern already used for permissions: cache-mode: none at the workflow level of every workflow, and a job-level grant only where actions/setup-go (which caches by default) or build-push-action type=gha needs one.

Workflow	Job	Mode	Reason
ci.yml	test, lint, docs, dockerflags, dogfooding	write	setup-go cache saved on main, restored by pull requests
ci.yml	docker	write	cache-to: type=gha
codeql.yml	analyze	write	setup-go cache, CodeQL caches
pages.yml	build	write	setup-go cache holds the Hugo tool build
release.yml	build	read	Restores the main cache; a save scoped to a tag ref is never restored by another run
sarif-upload-check.yml	upload-check	read	Restores only; ci.yml already saves the same key on main
everything else		none

Also:

• codeql.yml gets the workflow-level permissions: {} the other workflows already carry (the analyze job's own permissions are unchanged).
• AGENTS.md documents the convention next to the permissions: {} rule.

Notes

• A cache operation refused by the mode is logged and the step continues, so the read jobs skip the setup-go post-step save rather than fail.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AKZPpJJVhgvmm2GZbX3nxV

---

Generated by Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.