chore(Makefile): update govulncheck command to use pinned toolchain

Makefile

@@ -17,7 +17,8 @@ GOCLEAN=$(GOCMD) clean
 # Tool versions (compiled on demand via `go run` so they match the local toolchain)
 GOLANGCI_LINT = go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
 STATICCHECK   = build/tools/staticcheck
-GOVULNCHECK   = go run golang.org/x/vuln/cmd/govulncheck@latest
+# Scan with the toolchain pinned in go.mod (what CI uses), so stdlib vulns match CI.
+GOVULNCHECK   = GOTOOLCHAIN=go$(shell awk '/^go /{print $$2; exit}' go.mod) go run golang.org/x/vuln/cmd/govulncheck@latest
 
 # Version information
 # VERSION file is the single source of truth (bumped by `make release-version`).
@@ -218,7 +219,7 @@ docker-test-integration: docker-up ## Start DB and run integration tests
 		$(GOTEST) -v ./pkg/readers/pgsql/ -count=1 || (make docker-down && exit 1)
 	@make docker-down
 
-release: lint fmt-check test build ## Run lint, format check, tests, build, then create and push a new release tag
+release: lint fmt-check govulncheck test build ## Run lint, format check, govulncheck, tests, build, then create and push a new release tag
 	@echo "Creating new release..."
 	@latest_tag=$$(git describe --tags --abbrev=0 2>/dev/null || echo ""); \
 	if [ -z "$$latest_tag" ]; then \
@@ -252,7 +253,7 @@ release: lint fmt-check test build ## Run lint, format check, tests, build, then
 	git push origin "$$version"; \
 	echo "Tag $$version created and pushed to remote repository."
 
-release-version: lint fmt-check staticcheck ## Run lint, format check and staticcheck, then auto-increment patch version, update VERSION/package files, commit, tag, and push
+release-version: lint fmt-check staticcheck govulncheck ## Run lint, format check, staticcheck and govulncheck, then auto-increment patch version, update VERSION/package files, commit, tag, and push
 	@CURRENT=$$([ -f VERSION ] && cat VERSION | tr -d '[:space:]' || (git describe --tags --abbrev=0 2>/dev/null | sed 's/^v//') || echo "0.0.0"); \
 	MAJOR=$$(echo $$CURRENT | cut -d. -f1); \
 	MINOR=$$(echo $$CURRENT | cut -d. -f2); \
@@ -269,7 +270,7 @@ release-version: lint fmt-check staticcheck ## Run lint, format check and static
 	git push origin HEAD "$$NEXT"; \
 	echo "Pushed $$NEXT — release workflow triggered"
 
-rerelease: lint fmt-check ## Move the latest tag to HEAD and force push it
+rerelease: lint fmt-check govulncheck ## Move the latest tag to HEAD and force push it
 	@TAG=$$(git describe --tags --abbrev=0 2>/dev/null); \
 	if [ -z "$$TAG" ]; then echo "No existing tags found"; exit 1; fi; \
 	echo "Moving $$TAG to $$(git rev-parse --short HEAD)"; \