fix(ci): re-pin golangci-lint install.sh checksum for v2.13.1

setup-tools fetches install.sh from a version-scoped URL
(raw.githubusercontent.com/golangci/golangci-lint/${VERSION}/install.sh)
but verified it against a version-independent hardcoded constant. When
#2351 bumped linting.golangci_lint from v2.12.2 to v2.13.1, the pin went
stale and every E2E job started failing:

  Expected: d32d3534...  (install.sh at v2.12.2)
  Actual:   1022ddb4...  (install.sh at v2.13.0 and v2.13.1)

Only tests/E2E is affected because it is the sole job that runs
tools/setup-tools; tests/Lint uses golangci/golangci-lint-action, which
does its own checksum handling.

Re-pin to the v2.13.1 hash and document the coupling inline, since
Renovate bumps the version without knowing the hash exists.

Follow-up: GRYPE_INSTALL_SHA256 has the same shape but tracks the
upstream main branch, so it can break with no version bump at all. Both
would be better served by the release-checksums.txt pattern already used
for flux and zarf in this file.

Signed-off-by: Mark Chmarny <mark@chmarny.com>

Author: mchmarny

tools/setup-tools

@@ -378,7 +378,10 @@ if [[ "${SKIP_TOOLS}" == "false" ]]; then
     echo "════════════════════════════════════════════════════════"
 
     GRYPE_INSTALL_SHA256=${GRYPE_INSTALL_SHA256:-"8646f06a90b10ca64992c1809b4aa00c44e30b4f551f63c309b0b0ab66873556"}
-    GOLANGCI_LINT_INSTALL_SHA256=${GOLANGCI_LINT_INSTALL_SHA256:-"d32d3534af96cfd59546a084d22b213e8a47541cada5013aa8a84c4fa2589905"}
+    # install.sh is fetched from the golangci-lint tag in .settings.yaml, so this
+    # hash is version-specific: re-pin it whenever linting.golangci_lint is bumped.
+    #   curl -fsSL "https://raw.githubusercontent.com/golangci/golangci-lint/$(yq '.linting.golangci_lint' .settings.yaml)/install.sh" | shasum -a 256
+    GOLANGCI_LINT_INSTALL_SHA256=${GOLANGCI_LINT_INSTALL_SHA256:-"1022ddb4d87ed252350ed03fc9677e250a4ae95cc6bcd4658c2a20a8a23d390f"}
 
     if command_exists helm && [[ "${UPGRADE}" != "true" ]]; then
         log_success "Helm already installed: $(helm version --short)"