fix(ci): drop the duplicate Go cache restore and pin token permissions

setup-go's cache:true already caches the build and module caches keyed
on go.sum; the extra actions/cache step restored the same read-only
~/go/pkg/mod on top and failed with "Cannot open: File exists" whenever
both caches hit. Also sets the workflow's GITHUB_TOKEN to contents:read.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -8,6 +8,9 @@ on:
       - "v[0-9]+.[0-9]+.[0-9]+"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   lint-and-test:
     runs-on: ubuntu-latest
@@ -23,7 +26,9 @@ jobs:
           echo "Expected Node: $NVMRC"
           grep -q "node:${NVMRC}-slim" Dockerfile || { echo "::error::Dockerfile node tag != .nvmrc ($NVMRC)"; exit 1; }
 
-      # Go setup and cache
+      # Go setup and cache (setup-go's cache:true already covers the build cache
+      # and the module cache; a second actions/cache restore over the read-only
+      # ~/go/pkg/mod collides with "File exists" whenever both caches hit)
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
@@ -31,17 +36,6 @@ jobs:
           cache: true
           cache-dependency-path: backend/go.sum
 
-      # Cache Go dependencies
-      - name: Go Mod Cache
-        uses: actions/cache@v5
-        with:
-          path: |
-            ~/.cache/go-build
-            ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ hashFiles('backend/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-
-
       # pnpm setup
       - name: Install pnpm
         uses: pnpm/action-setup@v4