ci: switch Go CodeQL to manual build mode

autobuild is a black box — if it fails for any reason (CGO/libpcap
timing, module cache, etc.) no SARIF gets uploaded and GitHub reports
'1 configuration not found: /language:go' on the PR.

Switching to build-mode: manual with an explicit 'go build ./...'
step placed after CodeQL init (so the build is traced) gives us a
deterministic, visible build step. libpcap-dev is still installed
before init so the CGO dependency is satisfied.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/codeql.yml

@@ -25,7 +25,7 @@ jobs:
           - language: actions
             build-mode: none
           - language: go
-            build-mode: autobuild
+            build-mode: manual
           - language: javascript-typescript
             build-mode: none
           - language: python
@@ -46,6 +46,10 @@ jobs:
           build-mode: ${{ matrix.build-mode }}
           config-file: ${{ matrix.language == 'go' && './.github/codeql-config.yml' || '' }}
 
+      - name: Build Go (required for manual build-mode)
+        if: matrix.language == 'go'
+        run: go build ./...
+
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
         with: