feat: add Go modules (go.mod) support

[algomaster99]

Summary

yul now checks go.mod (#4): pkg/golang parses require entries via git-pkgs/manifests and flags any newly added/changed one pinned older than the latest release, same as the existing Maven/npm/PyPI/GitHub Actions checkers. Unlike those manifests, go.mod's require syntax has no ranges/operators at all — every entry is already an exact module version pair, so there's no bare-vs-range disambiguation to do.

Before (Claude writes a stale exact pin, nothing catches it):

$ echo 'require github.com/google/uuid v1.3.0' >> go.mod
$ # write succeeds silently; v1.3.0 is two years stale (latest: v1.6.0)

After:

outdated dependencies, use these versions instead:
  github.com/google/uuid  v1.3.0 -> v1.6.0

(exit 2, write blocked — Claude sees the correct version on stderr and retries)

Known gap, left for a follow-up: a module pinned to a pseudo-version (v0.0.0-<timestamp>-<hash>, Go's format for an untagged commit) always compares as older than any tagged release and gets flagged, even when the pin is deliberate (e.g. picking up an unreleased fix). go get/Renovate handle this by falling back to digest-tracking — resolving the module's latest commit and suggesting a newer pseudo-version instead of a tag — but that needs a resolver capability (VCS tip lookup) git-pkgs/enrichment doesn't currently expose, so it's out of scope here. go-06-pseudo-version-unreleased-fix in benchmark/cases.json exercises this scenario.

Changes

• pkg/golang/gomod.go (new): Checker for go.mod. A few Go-specific cases needed a design pass — given:

  require (
      github.com/google/uuid    v1.3.0                                   // checked normally: v1.3.0 -> v1.6.0
      golang.org/x/sync         v0.0.0-20210220032951-036812b2e83c       // pseudo-version: always compares older than any tag
      github.com/some/v2mod     v2.3.4+incompatible                      // "+incompatible" ignored as build metadata
  )
  
  replace github.com/google/uuid => github.com/google/uuid v1.0.0        // not seen at all - git-pkgs/manifests doesn't parse replace as a dependency
  

  the pseudo-version and +incompatible cases are exercised in the tests below; the replace gap is a known parser limitation, same category as e.g. Maven's <parent> version-as-property.
• pkg/golang/gomod_test.go (new): parsing (single-line/block require, indirect, replace ignored), fresh pin below/at latest, untouched-pin skip, pseudo-version and +incompatible cases.
• main.go / main_test.go: wire golang.Checker into the checker registry; fix a test that asserted go.mod was unknown (now Cargo.toml, which still is).
• README.md / CLAUDE.md: add go.mod to the supported-manifests list.
• benchmark/cases.json: go-01..06 cases (resty/cobra/zap/uuid fresh, testify existing, pseudo-version-pin fresh).