fix(ci): pin setup-go SHA and update migration README

Pin actions/setup-go to SHA 4a3601...c1c06c (v6.4.0) in all three
migrate jobs (AWS, GCP, Azure); the pre-existing @v5 tag was unpinned,
inconsistent with every other workflow in the repo.

Update .github/workflows/README.md to accurately describe the down-
migration guards introduced in this PR: replace the stale "warns on
prod down migrations" bullet with the actual fail-closed behavior
(explicit steps required, rollback-prod confirmation for prod), and
add a prod-down example command showing the confirm input.

Author: cristim

.github/workflows/README.md

@@ -342,6 +342,14 @@ gh workflow run database-migration.yml \
   -f direction=down \
   -f steps=2
 
+# Rollback 1 migration on AWS prod (requires typed confirmation)
+gh workflow run database-migration.yml \
+  -f cloud=aws \
+  -f environment=prod \
+  -f direction=down \
+  -f steps=1 \
+  -f confirm=rollback-prod
+
 # Apply to all clouds
 gh workflow run database-migration.yml \
   -f cloud=all \
@@ -351,10 +359,11 @@ gh workflow run database-migration.yml \
 
 ### Safety Features
 
-- **Validation** - Checks migration files exist
-- **Production Warnings** - Warns on prod down migrations
-- **Audit Trail** - Records all migrations
-- **Step Control** - Apply specific number of migrations
+- **Validation** - Checks migration files exist before running
+- **Explicit steps required** - `direction=down` requires an explicit positive `steps` value; `steps=0` (the default, which would run `down -all` and drop the entire schema) is rejected
+- **Production confirmation** - `direction=down` on `environment=prod` additionally requires typing `rollback-prod` in the `confirm` input; omitting or mistyping it blocks the run
+- **Defense in depth** - each migrate job independently re-validates the positive-steps constraint, so a future validate regression cannot reach `down -all`
+- **Audit Trail** - Records all migrations in the step summary
 
 ---
 

.github/workflows/database-migration.yml

@@ -177,7 +177,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
 
@@ -253,7 +253,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
 
@@ -320,7 +320,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod