Extend the Tekton go-ci task with correctness and supply-chain gates that
previously had no CI coverage:
- go vet ./...
- gofmt -l (fails on unformatted files)
- go mod tidy drift check
- golangci-lint (warn-only via LINT_REQUIRED=false until baseline cleanup)
- go test -race -shuffle=on -count=1
- govulncheck ./... (symbol-reachable vulns fail the build)
Refactor existing steps onto a stepTemplate so env (GOFLAGS, GOCACHE,
GOMODCACHE, GOTOOLCHAIN=local) is shared. Pin GOTOOLCHAIN to prevent
silent toolchain upgrades inside CI.
Add minimal .golangci.yml enabling errcheck, gofmt, govet, ineffassign,
staticcheck, unused, misspell, bodyclose, errorlint. Tests exempted from
errcheck/bodyclose. Flip LINT_REQUIRED=true after the cleanup PR lands.
Refs forgejo-mcp-f37.
738d979553