CI: GOPROXY '|direct' fallthrough turns a proxy blip into a bogus 'unknown revision' failure

> 🤖 Generated by the Agentic Engineer

## Evidence

`⛵ Operator Chart E2E` failed on PR #6747 ([job](https://github.com/devantler-tech/ksail/actions/runs/33211103037/job/98984345563)) with:

```
go: downloading github.com/rancher/dynamiclistener v1.27.5
github.com/rancher/dynamiclistener/cert: reading github.com/rancher/dynamiclistener/go.mod
at revision v1.27.5: unknown revision v1.27.5
##[error]Process completed with exit code 1.
```

The PR changed one Playwright spec file. Every later step (`☸️ Create kind cluster`, `📦 Load image`, `🚀 Install chart`, `✅ Verify deployment`) was skipped, so the failure diagnostics then reported `dial tcp [::1]:8080: connect: connection refused` from `kubectl` — which reads like a broken cluster and is actually just the absence of one.

The module is fine. Checked against the module proxy at the time of the failure:

| endpoint | status |
|---|---|
| `.../@v/v1.27.5.info` | 200 |
| `.../@v/v1.27.5.mod` | 200 |
| `.../@v/v1.27.5.zip` | 200 |

and `go.sum` pins it exactly (`h1:FA/s9vbQ...`, `/go.mod h1:VqBaJNi+...`).

## Problem

Every Go workflow sets `GOPROXY: "https://proxy.golang.org|direct"`. The `|` separator falls through to the next source on **any** error; `,` falls through only on 404/410.

`dynamiclistener` is not in `go.mod` — it is a test dependency of a transitive dependency (`k3d` → `wharfie/pkg/registries.test`), reachable only when a step resolves the full test graph. When the proxy path errors transiently, `|` silently degrades to `direct`, which resolves from the VCS, where that revision does not exist. The build then fails with `unknown revision` — a message that describes a permanent dependency breakage while the real cause is a momentary proxy blip.

**Impact.** Random, unattributable CI reds on unrelated PRs, presented in the most misleading way available: the visible error blames a dependency, and the visible symptom blames the cluster. The true cause appears nowhere.

## Expected

A transient proxy failure fails as a proxy failure, or not at all — it never silently degrades to a source that cannot serve the pinned module.

## Acceptance criteria

- [ ] All 7 occurrences use `https://proxy.golang.org,direct`:
`.github/workflows/{ci,cd,system-test-omni,system-test-hetzner,system-test-eks}.yaml`,
`.github/actions/operator-chart-e2e/action.yml`, `.github/actions/cache-ksail-binary/action.yaml`
- [ ] A green CI run confirms normal module resolution is unaffected
- [ ] Consider whether this belongs in the shared `devantler-tech/actions` Go setup rather than being repeated per workflow

**Size:** small — a one-character change in 7 files, plus a judgement call on where the value should live.

Review the seven named workflow and action files for their GOPROXY settings, then check whether the shared devantler-tech/actions Go setup is the appropriate central location. Change the separator as specified, verify that all seven occurrences are covered, and confirm a green CI run with normal module resolution.

Written by the indexing model from the issue text.