[vcauesantos]

Summary

• Move the pinned semstat release from v0.0.3 to v0.0.4. This is the only pin, and both setup-semstat and semver-validation read it.
• v0.0.4 is the same code built with Go 1.26.10. Go 1.26.10 rejects certificates chained through the compromised eMudhra intermediates (GO-2026-6809), and v0.0.3 was built with Go 1.26.3.

Test plan

• bats .github/actions/setup-semstat/test/*.bats: 56/56 pass.
• The release itself: published and immutable, all assets match checksums.txt, both the linux/amd64 and darwin/arm64 binaries report go1.26.10, and semstat version prints 0.0.4.
• This PR runs test-setup-semstat and test-semver-validation, including real installs with verify-signature: true that check the v0.0.4 cosign signature against semstat's release workflow.

After merge

Callers use the rolling tags, so move both to the merge commit:

• setup-semstat/v1
• semver-validation/v4

Both tags point at de873f4 today, and neither action changed between de873f4 and main, so the move carries only this bump.

Related to DEVOPS-1712