chore(ci): bump nox 1.16.1 fleet-wide across reusable workflows

[felixgeelhaar]

What

Bumps the pinned nox release in the three shared reusable workflows so every caller repo picks up nox 1.16.1's SAST + dependency ruleset:

Workflow	From → To
go-ci.yml	1.10.0 → 1.16.1
nox-remediate.yml	1.13.6 → 1.16.1
js-ci.yml	1.4.1 → 1.16.1

nox-sha256 → e0d7edf53d3b2b34bf899bc19c21e31fe2f5e3757432e51fb453f5d9d521bf7d (nox_1.16.1_linux_amd64.tar.gz), verified against the release checksums.txt.

⚠️ Merge ordering — land the remediation PRs FIRST

Flipping this pin re-scans every caller. The self-adjusting gate fails the build on net-new critical/high in any repo with a committed baseline. I scanned all callers under 1.16.1; the ones that would break have remediation PRs open. Merge those before this PR:

• fix(security): remediate known CVEs in Go + JS deps coverctl#120 (grpc, postcss, svgo, sharp)
• fix(security): bump grpc + x/text to patched versions fortify#61 (grpc, x/text)
• fix(security): bump grpc to patched version mcp-go#134 (grpc)
• fix(security): remediate known CVEs in Go + JS deps (nox 1.16.1) rollops#92 (grpc, postcss)
• fix(security): remediate known CVEs in Go + JS deps (nox 1.16.1) scout#69 (grpc, postcss, brace-expansion)
• fix(security): remediate known CVEs in JS deps statekit#93 (fast-uri, postcss, svgo)
• klarlabs-studio/armada#211 (astro, undici, vite, ws, postcss, svgo, sharp, js-yaml, linkify-it, fast-uri, form-data, brace-expansion)

Report-only (won't break — gitignored baseline — but real CVEs fixed anyway):

• fix(security): remediate known CVEs in Go deps + langgraph example mnemos#273 (grpc, x/text, cel-go, langgraph)
• fix(security): remediate x/crypto, x/net, x/image, grpc, excelize CVEs across workspace modules agent-go#82 (x/crypto cluster, x/net, x/image, grpc, excelize)

Clean under 1.16.1 (no action): auth-go, axi-go, bolt, briefkasten, rollops-studio, warden, fortify-ts.

https://claude.ai/code/session_01Cr6YdzphmFF3NJqm7kSJom