gh-oss-go-bump

SUSPICIOUS: The workflow is purpose-aligned for bulk Go version bumps and mostly uses official GitHub/Go tooling, but it depends on a third-party `gh oss-watch` extension from a personal repository that operates in an authenticated GitHub CLI environment. The main risk is extension trust and token exposure, not overt malicious behavior; the cleanup command is scoped and the confirmation gates reduce autonomy risk.