ci: add scheduled go toolchain update workflow

.github/workflows/go-toolchain-update.yml

@@ -0,0 +1,133 @@
+name: Go Toolchain Update
+
+on:
+  schedule:
+    # Align with Dependabot weekly checks: Monday 00:00 UTC (08:00 Asia/Shanghai).
+    - cron: "0 0 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  update-go-toolchain:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Check Go toolchain baseline
+        id: versions
+        run: |
+          current="$(python3 hack/go-toolchain.py current)"
+          latest="$(python3 hack/go-toolchain.py latest)"
+
+          echo "current=${current}" >> "$GITHUB_OUTPUT"
+          echo "latest=${latest}" >> "$GITHUB_OUTPUT"
+
+          if [ "$current" = "$latest" ]; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "Go toolchain already matches latest stable Go ${latest}."
+            exit 0
+          fi
+
+          echo "changed=true" >> "$GITHUB_OUTPUT"
+          echo "Go toolchain update needed: ${current} -> ${latest}."
+
+      - name: Update Go toolchain baseline
+        if: steps.versions.outputs.changed == 'true'
+        run: |
+          python3 hack/go-toolchain.py update --version "${{ steps.versions.outputs.latest }}"
+
+      - name: Set up Go
+        if: steps.versions.outputs.changed == 'true'
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: go.mod
+
+      - name: Verify Go toolchain baseline
+        if: steps.versions.outputs.changed == 'true'
+        run: |
+          go mod tidy
+          python3 hack/go-toolchain.py verify --check-latest --require-latest
+          git diff --check
+          git diff --exit-code -- .github/workflows
+
+      - name: Create or update pull request
+        if: steps.versions.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TARGET_GO_VERSION: ${{ steps.versions.outputs.latest }}
+        run: |
+          branch="chore/go-toolchain-${TARGET_GO_VERSION//./}"
+          title="chore: update Go toolchain to ${TARGET_GO_VERSION}"
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git fetch origin "+refs/heads/${branch}:refs/remotes/origin/${branch}" || true
+          git switch -C "$branch"
+          git add go.mod go.sum docker/Dockerfile docker/Dockerfile.router docker/Dockerfile.picod
+
+          if git diff --cached --quiet; then
+            echo "No Go toolchain changes remain after update."
+            exit 0
+          fi
+
+          git commit -s -m "$title"
+          git push --force-with-lease="refs/heads/${branch}" origin "$branch:$branch"
+
+          cat > /tmp/go-toolchain-pr-body.md <<EOF
+          **What type of PR is this?**
+
+          /kind cleanup
+
+          **What this PR does / why we need it**:
+
+          Updates the project Go toolchain baseline to Go ${TARGET_GO_VERSION}.
+
+          This PR keeps the Go baseline aligned across \`go.mod\` and Docker \`golang:*\` builder image tags. GitHub Actions already read the Go version from \`go.mod\` via \`go-version-file: go.mod\`, so regular post-#391 Go baseline updates should not need workflow file changes.
+
+          **Which issue(s) this PR fixes**:
+
+          NONE
+
+          **Special notes for your reviewer**:
+
+          - Generated by the scheduled Go Toolchain Update workflow.
+          - Validation run in the workflow:
+            - \`python3 hack/go-toolchain.py update --version ${TARGET_GO_VERSION}\`
+            - \`go mod tidy\`
+            - \`python3 hack/go-toolchain.py verify --check-latest --require-latest\`
+            - \`git diff --check\`
+            - \`git diff --exit-code -- .github/workflows\`
+          - PRs created with \`GITHUB_TOKEN\` may not recursively trigger every downstream workflow, so normal PR CI should still be checked before merge.
+
+          **Does this PR introduce a user-facing change?**:
+
+          \`\`\`release-note
+          NONE
+          \`\`\`
+          EOF
+
+          existing_pr="$(
+            gh pr list \
+              --base main \
+              --head "$branch" \
+              --state open \
+              --json number \
+              --jq '.[0].number // ""'
+          )"
+
+          if [ -n "$existing_pr" ]; then
+            gh pr edit "$existing_pr" --title "$title" --body-file /tmp/go-toolchain-pr-body.md
+          else
+            gh pr create \
+              --base main \
+              --head "$branch" \
+              --title "$title" \
+              --body-file /tmp/go-toolchain-pr-body.md
+          fi