v0.3.1 - catalog v1.6.0 / ci-go consumer

Behavioral change: none. Routine bump consuming the catalog's new
ci-go pre-baked builder image. Verifies ci-go end-to-end:
- go-build (branch jobs): pulls ci-go for cross-compile
- go-release-binary (tag): pulls ci-go for cross-compile + cosign sign
- go-audit (lint stage): pulls ci-go, govulncheck pre-installed
- go-sbom (tag): pulls ci-go, syft pre-installed
- slsa-attest (tag): pulls ci-go, cosign pre-installed
- bairn-side test + drift-gate: also flipped to ci-go

Authenticated pull from registry.gitlab.com replaces v0.3.0's
mirror.gcr.io stopgap.