chore: harden CLI toolchain access on arch-reset

[binarylogic]

Summary\n- point Hermit at the company overlay plus upstream fallback\n- authenticate Hermit source access in GitHub Actions before activation\n- align the Go toolchain declaration with the Hermit-managed version\n\n## Testing\n- ruby -e 'require "yaml"; ARGV.each { |f| YAML.load_file(f) }' .github/workflows/_go-checks.yaml .github/workflows/nightly.yaml\n- bash -lc 'eval "export PATH='/Users/ben/code/usetero/worktrees/cli-arch-reset-hardening/.hermit/go/bin:/Users/ben/code/usetero/worktrees/cli-arch-reset-hardening/bin:/Users/ben/.codex/tmp/arg0/codex-arg0U36tlv:/Users/ben/.volta/tools/image/packages/@openai/codex/lib/node_modules/@openai/codex/node_modules/@openai/codex-darwin-arm64/vendor/aarch64-apple-darwin/path:/Users/ben/.volta/tools/image/npm/11.4.2/bin:/Users/ben/.volta/tools/image/node/25.8.0/bin:/opt/homebrew/opt/libpq/bin:/Users/ben/.volta/bin:/Users/ben/bin:/Users/ben/.local/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/opt/pkg/env/active/bin:/opt/pmk/env/global/bin:/Applications/Little Snitch.app/Contents/Components:/Applications/Ghostty.app/Contents/MacOS:/Users/ben/.orbstack/bin'

export HERMIT_BIN='/Users/ben/code/usetero/worktrees/cli-arch-reset-hardening/bin'
export HERMIT_ENV='/Users/ben/code/usetero/worktrees/cli-arch-reset-hardening'
export GOBIN='/Users/ben/code/usetero/worktrees/cli-arch-reset-hardening/.hermit/go/bin'
export GOROOT='/Users/ben/Library/Caches/hermit/pkg/go-1.26.0'
export GOTOOLCHAIN='local'" && go version'

[acslater00]

@binarylogic what is going on with this PR

[github-actions]

This PR is stale because it has been open for 30 days with no activity. Remove stale label or comment or this will be closed in 7 days.