fix(go-ci): stage per-function coverage in RUNNER_TEMP, not shared /tmp

[monsieurleberre]

Closes #12.

Context

Issue #12 reported go-ci.yaml's coverage step failing on the self-hosted Hetzner runner because it called sudo. That sudo chown was already removed in PR #29 (commit 115dc93, released v2.3.2) — the step now takes ownership of the root-owned coverage report via a same-directory cp + mv -f copy that needs only workspace permissions. The issue stayed open only because #29 never linked it. Independently confirmed: no sudo invocation remains anywhere in go-ci.yaml on dev.

This change

Hardens the one residual self-hosted hazard in the same step. Per-function coverage was staged at the fixed path /tmp/cov-func.txt. On shared Hetzner hosts /tmp outlives the job and is shared across runner instances, so a leftover file owned by another runner user fails the step with permission-denied (same failure class as the v2.3.3 dotnet-coverage fix), and concurrent Go jobs on one host can cross-contaminate the coverage column. It now uses "$RUNNER_TEMP/cov-func.txt" — per-runner-instance, emptied at the start and end of every job. Behavior on GitHub-hosted runners is unchanged.

Verification

• actionlint clean; shellcheck -s bash clean on the extracted step script.
• All three touchpoints (truncate, append, read) updated consistently; no dangling /tmp/cov-func.txt reference remains.
• Pre-open review: SHIP.

Note for closing

v1 (frozen at d072766) still contains the original sudo chown; @v1 consumers must migrate to @v2.