fix(ci): sync setup-go contract pin

[ss-o]

Summary

Update the hardened wiki-sync workflow-contract expectations to the reviewed actions/setup-go v7 commit already used by the live workflow.

This is a one-file prerequisite repair. It does not modify the workflow or include the pending wikidoc promotion.

Root cause

Dependabot PR #88 updated actions/setup-go from v6.5.0 to v7.0.0 in the workflow, but the exact contract expectations retained the previous pinned commit and mutable-ref mutation. Untouched main therefore failed two workflow-contract tests.

Impact

The contract again validates the exact action pin used by the workflow, restoring the full Go test gate on main and unblocking the separate exact wikidoc promotion from #94.

Verification

• reproduced both failures on untouched origin/main
• go test ./internal/workflowcontract -count=1
• go test ./...
• go vet ./...
• GOFLAGS=-buildvcs=false go build ./...
• trunk check internal/workflowcontract/wiki_docs_sync_test.go
• confirmed the resulting contract file exactly matches the green next version

Closes #91.

Prerequisite for the exact main promotion of #94.

[Copilot]

Pull request overview

This PR fixes a drift between the hardened workflow-contract expectations and the live GitHub Actions workflow by updating the pinned actions/setup-go commit SHA used in the contract test to match the already-reviewed v7 commit used in .github/workflows/wiki-docs-sync.yml.

Changes:

• Update the expected actions/setup-go exact pin in wiki_docs_sync_test.go from the v6.5.0 commit to the v7.0.0 commit (b7ad1dad...).
• Update the corresponding mutation test case to use actions/setup-go@v7 (mutable ref) as the invalid replacement, aligning with the new major version.

[ss-o]

Post-merge metadata audit: the signed source commit contained no prohibited coauthor trailer, but the GitHub-generated squash message added one to published commit e340a6cbba21bc053d13a82d451ab51f30916da6. Protected main history was not rewritten. The immediately following #96 merge used an explicit squash subject and one-line body, and published commit d390a963e5f5c92c0d73054360c1f4d486ffe942 was verified to contain no such trailer. The canonical safeguard is documented in the organization branch-protection runbook.