Opt ci-go's workflow_call arm out of signed auto-fixes so it does not race the org-required signer

> 🤖 Generated by the Agentic Engineer

## Evidence

`.github/workflows/ci.yaml`'s `ci-go` job calls `devantler-tech/actions/.github/workflows/validate-go-project.yaml` through `workflow_call` (pinned at v13.2.3 today) and passes `APP_PRIVATE_KEY`. Once this repository bumps past the release that turns signed auto-fix commits on by default (devantler-tech/actions#1134, `Fixes devantler-tech/actions#1075`), that arm opts in too — while the org-required **direct** run of the same workflow already signs for every pull request here.

## Impact

On a same-repository pull request where both run, both would export a patch and dispatch apply jobs whose `createCommitOnBranch` mutation is pinned to the same branch tip; the second is rejected as stale. Today the only thing preventing that race is `ci-go`'s `govuln-allowlist` path filter, under which the fixer lanes are skipped — a gate in another file that nothing ties to this behaviour. Found in review of devantler-tech/actions#1134.

## Expected behaviour

Exactly one signer targets a pull-request branch here: the org-required direct run. The `ci-go` arm stays read-only.

## Acceptance criteria

- [ ] `ci-go` passes `apply-signed-fixes: false`, with a comment naming the direct run as the signer.
- [ ] Landed together with, or before, the actions pin bump that carries #1134.

Rough size: XS.

Part of devantler-tech/actions#1075

Start in .github/workflows/ci.yaml at the ci-go job and inspect its workflow_call inputs for the pinned devantler-tech/actions validate-go-project.yaml release. Confirm the actions pin involved in #1134 and the direct required run's signer behavior. Done when ci-go is read-only, the direct run remains the sole signer, and the workflow change is aligned with the pin bump.

Written by the indexing model from the issue text.