fix(ci): run lint tools via 'go run' to match the toolchain

Installed staticcheck/govulncheck binaries can fail when built with an
older Go than the module targets, and GOPATH/bin is not always on PATH.
Compile them on demand with 'go run <tool>@latest' in both the workflow
and the Makefile.

.gitea/workflows/release.yml

@@ -25,8 +25,7 @@ jobs:
 
       - name: gofumpt (golangci-lint fmt)
         run: |
-          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
-          diff=$(golangci-lint fmt --diff 2>&1)
+          diff=$(go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest fmt --diff 2>&1)
           if [ -n "$diff" ]; then
             echo "$diff"
             echo "Formatting issues found. Run: make fmt"
@@ -34,14 +33,10 @@ jobs:
           fi
 
       - name: staticcheck
-        run: |
-          go install honnef.co/go/tools/cmd/staticcheck@latest
-          staticcheck ./...
+        run: go run honnef.co/go/tools/cmd/staticcheck@latest ./...
 
       - name: govulncheck
-        run: |
-          go install golang.org/x/vuln/cmd/govulncheck@latest
-          govulncheck ./...
+        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...
 
       - name: Test
         run: go test ./...