Add tools.go to pin staticcheck as a module dependency so CI installs it from the module cache instead of re-downloading on every run.