feat(go): build out the full Go language bundle

The Go bundle was coverage-slice-only. Because it shipped no rule files, sync-language-bundle.sh (which fingerprints a project's bundle by spotting one of its rule files in .claude/rules/) couldn't detect it, so the coverage slice it did ship never stayed in sync. Adding the rules is what makes the bundle sync-maintainable, which was the point.

Brought Go to the full tier, matching elisp:
- claude/rules/go.md and go-testing.md, the style and testing rules (table-driven tests, go test -race, errors.Is over message matching, how the coverage slice fits). These two are also the sync fingerprint.
- claude/hooks/validate-go.sh, a PostToolUse hook that runs gofmt and go vet on each edited .go file. go vet type-checks, so compile and syntax errors surface at edit time. It deliberately doesn't auto-run tests, since a package's tests can be slow or integration-tagged and shouldn't fire on every keystroke.
- claude/settings.json, Go permissions plus the hook wiring.
- githooks/pre-commit, a secret scan and a gofmt check on staged .go.
- CLAUDE.md, the seed.

validate-go.sh is TDD'd by scripts/tests/validate-go.bats: a clean file passes, gofmt and vet failures both block with the JSON payload, and non-go, missing, or empty paths are ignored. I updated install-lang.bats test 7, which asserted Go installs no CLAUDE.md, to check the full bundle instead. Verified with a real install into a throwaway project and a green make test.

1 files changed, 62 insertions, 0 deletions

diff --git a/languages/go/claude/hooks/validate-go.sh b/languages/go/claude/hooks/validate-go.sh
new file mode 100755
index 0000000..c2c6ff1
--- /dev/null
+++ b/languages/go/claude/hooks/validate-go.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# Validate Go files after Edit/Write/MultiEdit.
+# PostToolUse hook: receives tool-call JSON on stdin.
+#
+# On success: exit 0 silent.
+# On failure: emit JSON with hookSpecificOutput.additionalContext so Claude
+# sees a structured error in its context, THEN exit 2 to block the tool
+# pipeline. stderr still echoes the error for terminal visibility.
+#
+# Phase 1: gofmt — formatting must be clean.
+# Phase 2: go vet — compile + suspicious-construct check on the file's package,
+#          run only when the file sits inside a module (go.mod found). go vet
+#          type-checks, so it surfaces compile and syntax errors too.
+#
+# Tests deliberately stop here: `go test` on the edited package can pull in slow
+# or integration-tagged tests that shouldn't fire on every keystroke. Run them
+# explicitly via `make coverage` / `go test`.
+
+set -u
+
+# Emit a JSON failure payload and exit 2. Arguments:
+#   $1 — short failure type (e.g. "GO VET FAILED")
+#   $2 — file path
+#   $3 — tool output (error body)
+fail_json() {
+    local ctx
+    ctx="$(printf '%s: %s\n\n%s\n\nFix before proceeding.' "$1" "$2" "$3" \
+        | jq -Rs .)"
+    cat <<EOF
+{"hookSpecificOutput": {"hookEventName": "PostToolUse", "additionalContext": $ctx}}
+EOF
+    printf '%s: %s\n%s\n' "$1" "$2" "$3" >&2
+    exit 2
+}
+
+f="$(jq -r '.tool_input.file_path // .tool_response.filePath // empty')"
+[ -z "$f" ] && exit 0
+[ "${f##*.}" = "go" ] || exit 0
+[ -f "$f" ] || exit 0
+
+# No toolchain on this machine — nothing to validate, don't block the edit.
+command -v gofmt >/dev/null 2>&1 || exit 0
+
+# --- Phase 1: formatting ---
+# gofmt -l prints the path when the file isn't gofmt-clean (and stays silent on
+# a parse error — go vet catches those in Phase 2). Show the diff so the fix is
+# obvious.
+if [ -n "$(gofmt -l "$f" 2>/dev/null)" ]; then
+    fail_json "GOFMT: file is not gofmt-clean" "$f" "$(gofmt -d "$f" 2>&1)"
+fi
+
+# --- Phase 2: vet (needs module context) ---
+command -v go >/dev/null 2>&1 || exit 0
+dir="$(dirname "$f")"
+gomod="$(cd "$dir" && go env GOMOD 2>/dev/null)"
+if [ -n "$gomod" ] && [ "$gomod" != "/dev/null" ]; then
+    if ! out="$(cd "$dir" && go vet . 2>&1)"; then
+        fail_json "GO VET FAILED" "$f" "$out"
+    fi
+fi
+
+exit 0