v1.6.0 - ci-go pre-baked image; Go templates flipped from mirror.gcr.io First of the per-language pre-baked builder images. Replaces v1.5.3's mirror.gcr.io stopgap with an authenticated pull from registry.gitlab.com/dunn.dev/pipeline/ci-go:latest, eliminating the docker.io unauthenticated pull rate cap that bit bairn's v0.3.0 tag pipeline twice. ci-go bundles: golang:1.25 + govulncheck + syft 1.32.0 + cosign 2.6.3. Tools pinned in containers/ci-go.Containerfile (single source of truth for versions). Catalog .gitlab-ci.yml grew a .container-build extends-target so ci-rust / ci-node / ci-py can land in upcoming minor releases without copy-paste churn. Templates affected: - go-build, go-release-binary, go-audit, go-sbom, slsa-attest Each template's tool install block is now \`command -v <tool> || install\` so consumers overriding \`image\` (e.g. with vanilla golang or alpine) still get a working pipeline. Backwards-compatible. Consumers using v1.5.x explicit \`image\` inputs keep their override; consumers on defaults silently switch to the faster, authenticated pull. Catalog v2.0 (TBD) may collapse the per-action templates into a single \`ci-<lang>\` swiss-army template; until then per-action stays.