feat(go): build out the full Go language bundle

The Go bundle was coverage-slice-only. Because it shipped no rule files, sync-language-bundle.sh (which fingerprints a project's bundle by spotting one of its rule files in .claude/rules/) couldn't detect it, so the coverage slice it did ship never stayed in sync. Adding the rules is what makes the bundle sync-maintainable, which was the point.

Brought Go to the full tier, matching elisp:
- claude/rules/go.md and go-testing.md, the style and testing rules (table-driven tests, go test -race, errors.Is over message matching, how the coverage slice fits). These two are also the sync fingerprint.
- claude/hooks/validate-go.sh, a PostToolUse hook that runs gofmt and go vet on each edited .go file. go vet type-checks, so compile and syntax errors surface at edit time. It deliberately doesn't auto-run tests, since a package's tests can be slow or integration-tagged and shouldn't fire on every keystroke.
- claude/settings.json, Go permissions plus the hook wiring.
- githooks/pre-commit, a secret scan and a gofmt check on staged .go.
- CLAUDE.md, the seed.

validate-go.sh is TDD'd by scripts/tests/validate-go.bats: a clean file passes, gofmt and vet failures both block with the JSON payload, and non-go, missing, or empty paths are ignored. I updated install-lang.bats test 7, which asserted Go installs no CLAUDE.md, to check the full bundle instead. Verified with a real install into a throwaway project and a green make test.

2 files changed, 83 insertions, 3 deletions

diff --git a/scripts/tests/install-lang.bats b/scripts/tests/install-lang.bats
index 0fb83e3..ecfbe01 100644
--- a/scripts/tests/install-lang.bats
+++ b/scripts/tests/install-lang.bats
@@ -79,14 +79,24 @@ teardown() {
   grep -qxF "coverage/" "$PROJECT/.gitignore"
 }
 
-@test "install-lang go: coverage-only slice lands without a CLAUDE.md" {
+@test "install-lang go: full bundle lands (rules, hook, settings, githook, CLAUDE.md, coverage)" {
   run bash "$INSTALL_LANG" go "$PROJECT"
 
   [ "$status" -eq 0 ]
+  # Coverage slice
   [ -f "$PROJECT/.claude/scripts/coverage-summary.go" ]
   [ -f "$PROJECT/coverage-makefile.txt" ]
+  # Language + testing rules — these are the bundle's sync fingerprint
+  [ -f "$PROJECT/.claude/rules/go.md" ]
+  [ -f "$PROJECT/.claude/rules/go-testing.md" ]
+  # PostToolUse validate hook, executable and wired into settings
+  [ -x "$PROJECT/.claude/hooks/validate-go.sh" ]
+  grep -qF "validate-go.sh" "$PROJECT/.claude/settings.json"
+  # Pre-commit githook
+  [ -x "$PROJECT/githooks/pre-commit" ]
+  # CLAUDE.md seeded
+  [ -f "$PROJECT/CLAUDE.md" ]
+  # Gitignore footprint
   grep -qxF ".claude/" "$PROJECT/.gitignore"
   grep -qxF "cover.out" "$PROJECT/.gitignore"
-  # The slice ships no rules of its own, so there is no Go CLAUDE.md to seed.
-  [ ! -f "$PROJECT/CLAUDE.md" ]
 }
diff --git a/scripts/tests/validate-go.bats b/scripts/tests/validate-go.bats
new file mode 100644
index 0000000..73e5936
--- /dev/null
+++ b/scripts/tests/validate-go.bats
@@ -0,0 +1,70 @@
+#!/usr/bin/env bats
+# Tests for the Go bundle's PostToolUse validate hook.
+#
+# The hook reads a tool-call JSON envelope on stdin, pulls the edited file's
+# path, and on a .go file runs gofmt (formatting) and go vet (compile +
+# suspicious constructs) on its package. Clean -> exit 0 silent. Dirty ->
+# exit 2 with a JSON hookSpecificOutput payload.
+
+HOOK="${BATS_TEST_DIRNAME}/../../languages/go/claude/hooks/validate-go.sh"
+
+setup() {
+  command -v go >/dev/null 2>&1 || skip "go toolchain not installed"
+  command -v gofmt >/dev/null 2>&1 || skip "gofmt not installed"
+  command -v jq >/dev/null 2>&1 || skip "jq not installed"
+  MOD="$(mktemp -d)"
+  printf 'module gohooktest\n\ngo 1.26\n' > "$MOD/go.mod"
+}
+
+teardown() {
+  [ -n "${MOD:-}" ] && rm -rf "$MOD"
+}
+
+# Pipe a PostToolUse envelope naming $1 as the edited file into the hook.
+run_hook() {
+  printf '{"tool_input":{"file_path":"%s"}}' "$1" | bash "$HOOK"
+}
+
+@test "clean formatted compiling file passes silently" {
+  printf 'package main\n\nfunc main() {\n\t_ = 1\n}\n' > "$MOD/main.go"
+  run run_hook "$MOD/main.go"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}
+
+@test "non-gofmt-clean file is blocked with a GOFMT failure" {
+  # Parses fine, but the body line is unindented -> gofmt would rewrite it.
+  printf 'package main\n\nfunc main() {\n_ = 1\n}\n' > "$MOD/bad_fmt.go"
+  run run_hook "$MOD/bad_fmt.go"
+  [ "$status" -eq 2 ]
+  [[ "$output" == *GOFMT* ]]
+  [[ "$output" == *hookSpecificOutput* ]]
+}
+
+@test "compile error is blocked with a vet failure" {
+  # gofmt-clean, but references an undefined identifier -> go vet reports it.
+  printf 'package main\n\nfunc main() {\n\t_ = undefinedThing\n}\n' > "$MOD/broken.go"
+  run run_hook "$MOD/broken.go"
+  [ "$status" -eq 2 ]
+  [[ "$output" == *VET* ]]
+  [[ "$output" == *hookSpecificOutput* ]]
+}
+
+@test "non-go file is ignored" {
+  printf 'plain text\n' > "$MOD/notes.txt"
+  run run_hook "$MOD/notes.txt"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}
+
+@test "missing file is ignored" {
+  run run_hook "$MOD/does-not-exist.go"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}
+
+@test "empty file_path is ignored" {
+  run bash -c "printf '{\"tool_input\":{}}' | bash '$HOOK'"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}