ci: pin gorelease and keep the v3 release PR off the blocking API gate

[jasoet]

Problem

The blocking API compatibility check step was guarded by:

if: github.ref_name != 'next' && github.base_ref != 'next'

On the eventual next → main v3 pull request, base_ref is main and ref_name is the merge ref — neither equals next, so the blocking gate fires and reports the whole intended v3 break set. The release PR would have been unmergeable.

Verified locally against a clean tree at this commit:

# summary
Inferred base version: none
Suggested version: v3.0.0

Also, a gate that can block a merge was floating on gorelease@latest — not reproducible.

Change

• Add github.head_ref != 'next' to the blocking condition and || github.head_ref == 'next' to the informational one, so anything involving next reports without gating.
• Pin gorelease to v0.0.0-20251113190631-e25ba8c21ef6, the golang.org/x/exp pseudo-version already in go.mod. Exposed as a workflow-level env var so both steps stay in lockstep.
• Document the "no baseline until the first non-prerelease /v3 tag" behaviour in a comment, since that is expected output for the release PR.
• Fix the stale /v2 module path in the .golangci.yml header comment.

Closes the first two "Open Process Items" in docs/plans/2026-07-22-v3-audit-backlog.md.