Scheduled CodeQL fails on k3d module checksum mismatch

> 🤖 Generated by the Agent Improver

## Description

The scheduled default-setup CodeQL run on `main` fails in the Go autobuild because downloading `github.com/k3d-io/k3d/v5@v5.9.0` produces a checksum that does not match the repository's `go.sum`. The push-triggered CodeQL run on the same head completed successfully shortly beforehand, so the scheduled and push analysis paths currently disagree.

## Steps to Reproduce

1. Inspect the scheduled CodeQL run `33340328399` on `main` head `1c4633a910b19491236e1d1ca2173af1a1562234`.
2. Open the failing `Analyze (go)` job and its `Autobuild` step.
3. Observe Go module verification reject `github.com/k3d-io/k3d/v5@v5.9.0` with a checksum mismatch and skip the analysis step.

## Expected Behavior

Scheduled and push-triggered CodeQL should analyze the same `main` head successfully while retaining Go's checksum verification.

## Actual Behavior

The scheduled Go analysis stops during autobuild with a module-auth security error. The JavaScript/TypeScript and Actions analyses pass, and the earlier push-triggered CodeQL run on the same head is green.

## Impact

The latest scheduled security analysis for Go is red, so the repository does not have a current complete CodeQL result for `main`. Treating this as merely a stale dashboard row would hide a real dependency-integrity failure.

## Acceptance Criteria

- [ ] Reproduce or otherwise establish the source of the checksum divergence using trusted dependency evidence.
- [ ] Resolve the scheduled-versus-push discrepancy without disabling checksum verification or blindly accepting a moved module artifact.
- [ ] A scheduled/default-setup CodeQL run completes the Go analysis successfully on the corrected `main` head.
- [ ] Normal CI and the push-triggered CodeQL path remain green.

## Environment

- Repository: `devantler-tech/ksail`
- Failing workflow: GitHub-managed CodeQL default setup
- Failing run: `33340328399`
- First observed: 2026-08-30

Start with scheduled run 33340328399, its Analyze (go) job, and the Autobuild step; compare it with the successful push-triggered CodeQL run on commit 1c4633a. Inspect go.sum and trusted dependency evidence to identify the checksum divergence without weakening verification. Done means scheduled and push-triggered Go analysis both complete successfully, with normal CI still green.

Written by the indexing model from the issue text.