fix: use file-level GHA annotation for unfixed vulnerability IDs

::error file=go.mod:: creates a file-level annotation visible via the
check run annotations API; plain ::error:: is log-only and not queryable.

https://claude.ai/code/session_018ji3prTSK6AKEFqRfZQbBQ

Author: claude

.github/workflows/engine-ci.yml

@@ -71,7 +71,7 @@ jobs:
           echo "govulncheck IDs found: ${ALL_IDS:-none}"
           ACTIONABLE_IDS=$(echo "$ALL_IDS" | grep -vE '^(GO-2026-4887|GO-2026-4883)$' || true)
           for ID in $ACTIONABLE_IDS; do
-            echo "::error title=Unfixed vulnerability::$ID — add to exclusion list or upgrade the affected dependency"
+            echo "::error file=go.mod,line=1,title=Unfixed vulnerability::$ID — add to exclusion list or upgrade the affected dependency"
           done
           ACTIONABLE=$(echo "$OUTPUT" | grep -E '^Vulnerability #[0-9]+:' | grep -vE 'GO-2026-4887|GO-2026-4883' || true)
           if [ -n "$ACTIONABLE" ]; then