docs: add a coordinated Go toolchain upgrade checklist #2403

Problem

Go upgrades touch several independently pinned surfaces, but there is no single contributor-facing upgrade checklist. We have module/workspace Go directives, workflow setup-go configuration, digest-pinned Go builder images, golangci-lint compatibility requirements, and existing standalone/integrated qualification gates.

The planned timezone autocomplete catalog for #2398 adds a concrete maintenance obligation: its checked-in name list will be generated from the pinned Go toolchain's timezone database. Refreshing that catalog is separate from updating the runtime timezone rules provided by Go's standard-library time/tzdata or installed system zoneinfo.

Requested outcome

Add a short developer-maintenance runbook/checklist and link it from the contributor workflow. Cover:

• Identify the intended Go release and review relevant release/security notes.
• Update applicable go.mod and go.work directives coherently, respecting separately published module compatibility floors rather than blindly raising every floor.
• Check workflow setup-go inputs and preserve explicit toolchain selection; inventory any independently pinned Go versions.
• Update Go builder-image tags and digests together where applicable.
• Verify golangci-lint supports the target Go version, including the Go version used to build the linter.
• Run existing generation tasks and refresh/check Go-version-sensitive generated assets, including the timezone catalog once implemented. Document generator provenance and the timezone-rule-versus-name-list distinction.
• Explain intentional dependency/checksum maintenance versus incidental go.work.sum churn, preserving workspace integration and GOWORK=off standalone-module proofs.
• Run the existing build, lint, offline test/race, standalone-module, demo, and relevant documentation/release checks; make any version-specific follow-ups explicit.
• Explain the response to an urgent timezone-rule update that cannot wait for routine toolchain/image maintenance; do not imply catalog regeneration updates rules.

Scope constraints

This issue is for a concise coordinated checklist, not a new update framework. Reuse existing commands and CI jobs. Do not introduce new CI jobs, network checks on every PR, or additional long-pole matrices merely to document maintenance.

Acceptance

• A contributor can find and follow one checklist that names all relevant pin owners and existing verification commands.
• It distinguishes toolchain selection, module minimum versions, runtime image zoneinfo, embedded timezone rules, and generated autocomplete names.
• It explains when regeneration is required and how intentional checksum changes are reviewed.
• No CI job or routine critical-path expansion is required by the documentation change.

Related: #807 (local exact-toolchain pinning and workspace/generator checksum isolation). That issue addresses execution mechanics; this one documents the coordinated upgrade procedure. Context: #2398.