feat(go): build out the full Go language bundle

The Go bundle was coverage-slice-only. Because it shipped no rule files, sync-language-bundle.sh (which fingerprints a project's bundle by spotting one of its rule files in .claude/rules/) couldn't detect it, so the coverage slice it did ship never stayed in sync. Adding the rules is what makes the bundle sync-maintainable, which was the point.

Brought Go to the full tier, matching elisp:
- claude/rules/go.md and go-testing.md, the style and testing rules (table-driven tests, go test -race, errors.Is over message matching, how the coverage slice fits). These two are also the sync fingerprint.
- claude/hooks/validate-go.sh, a PostToolUse hook that runs gofmt and go vet on each edited .go file. go vet type-checks, so compile and syntax errors surface at edit time. It deliberately doesn't auto-run tests, since a package's tests can be slow or integration-tagged and shouldn't fire on every keystroke.
- claude/settings.json, Go permissions plus the hook wiring.
- githooks/pre-commit, a secret scan and a gofmt check on staged .go.
- CLAUDE.md, the seed.

validate-go.sh is TDD'd by scripts/tests/validate-go.bats: a clean file passes, gofmt and vet failures both block with the JSON payload, and non-go, missing, or empty paths are ignored. I updated install-lang.bats test 7, which asserted Go installs no CLAUDE.md, to check the full bundle instead. Verified with a real install into a throwaway project and a green make test.

1 files changed, 13 insertions, 3 deletions

diff --git a/scripts/tests/install-lang.bats b/scripts/tests/install-lang.bats
index 0fb83e3..ecfbe01 100644
--- a/scripts/tests/install-lang.bats
+++ b/scripts/tests/install-lang.bats
@@ -79,14 +79,24 @@ teardown() {
   grep -qxF "coverage/" "$PROJECT/.gitignore"
 }
 
-@test "install-lang go: coverage-only slice lands without a CLAUDE.md" {
+@test "install-lang go: full bundle lands (rules, hook, settings, githook, CLAUDE.md, coverage)" {
   run bash "$INSTALL_LANG" go "$PROJECT"
 
   [ "$status" -eq 0 ]
+  # Coverage slice
   [ -f "$PROJECT/.claude/scripts/coverage-summary.go" ]
   [ -f "$PROJECT/coverage-makefile.txt" ]
+  # Language + testing rules — these are the bundle's sync fingerprint
+  [ -f "$PROJECT/.claude/rules/go.md" ]
+  [ -f "$PROJECT/.claude/rules/go-testing.md" ]
+  # PostToolUse validate hook, executable and wired into settings
+  [ -x "$PROJECT/.claude/hooks/validate-go.sh" ]
+  grep -qF "validate-go.sh" "$PROJECT/.claude/settings.json"
+  # Pre-commit githook
+  [ -x "$PROJECT/githooks/pre-commit" ]
+  # CLAUDE.md seeded
+  [ -f "$PROJECT/CLAUDE.md" ]
+  # Gitignore footprint
   grep -qxF ".claude/" "$PROJECT/.gitignore"
   grep -qxF "cover.out" "$PROJECT/.gitignore"
-  # The slice ships no rules of its own, so there is no Go CLAUDE.md to seed.
-  [ ! -f "$PROJECT/CLAUDE.md" ]
 }