- .gitea/workflows/ci.yml: lint, race tests (e2e excluded), and
govulncheck on push to main and PRs; shared composite action installs
protoc + pinned protoc-gen-go/protoc-gen-go-grpc and generates the
(gitignored) protobuf code before each Go job.
- .golangci.yml (v2 schema): govet, staticcheck, errcheck, ineffassign,
unused, misspell, gosec, revive; generated api/grpc/pb excluded.
- Makefile: vuln target (govulncheck) added and chained into qa.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
