feat: implement modern repository best practices, CI Gatekeeper, and Go 1.23+ compatibility

[lock14]

Description

This pull request implements comprehensive modern repository best practices across CI/CD automation, dependency updates, static analysis, security scanning, community standards, and machine-readable documentation, targeting Go 1.23+ compatibility.

Summary of Changes

1. Go 1.23+ Compatibility

• Configured go 1.23.0 in go.mod to ensure universal compatibility across all modern Go releases (Go 1.23 through 1.27+).
• Expanded CI test matrix across Go versions 1.23, 1.24, 1.25, 1.26, 1.27, and stable.

2. CI/CD & Quality Gates (.github/workflows/)

• CI Gatekeeper Pipeline (ci.yml):
  • format-and-tidy: Enforces gofmt -s, go mod verify, and go mod tidy git diff checks.
  • test: Multi-Go version matrix (1.23, 1.24, 1.25, 1.26, 1.27, stable) with -race -shuffle=on, atomic coverage profiles, and Codecov upload.
  • lint: Dedicated go vet and revive quality gate with .revive.toml.
  • govulncheck: Automated Go vulnerability static analysis.
  • ci-gatekeeper: Single aggregator job evaluating all upstream check statuses, serving as the sole required check for branch protection rules.
• Security Scanning (security.yml): CodeQL static analysis and scheduled weekly scans.
• Performance Regression Check (benchmark.yml): Preserved dynamic package change detection and benchdiff/benchstat 95% confidence interval checks, enhanced with concurrency cancellation and least-privilege permissions.
• Removed legacy monolithic go.yml.

3. Dependency Management & Health (.github/)

• Dependabot (.github/dependabot.yml): Weekly automated dependency checks for Go modules (with minor/patch grouping) and GitHub Actions.
• Issue Templates (.github/ISSUE_TEMPLATE/): Structured GitHub Issue Forms for bug reports (bug_report.yml), feature requests (feature_request.yml), and configuration routing (config.yml).
• Pull Request Template (.github/PULL_REQUEST_TEMPLATE.md): Standardized PR checklist ensuring generics compliance, zero-allocation reads, test coverage, and documentation synchronization.

4. Code Quality & Coverage Configuration

• Linter (.golangci.yml & revive.toml): Modernized linter configuration with strict rules for exported package/symbol documentation, cyclomatic complexity, and code health.
• Coverage (codecov.yml): Configured 80% project and patch coverage thresholds with 1% tolerance, ignoring benchmarks, examples, and documentation.

5. Community & Machine-Readable Documentation

• CONTRIBUTING.md: Developer guide covering architecture principles, table-driven testing, zero-allocation benchmarks, and PR workflows for Go 1.23+.
• SECURITY.md: Vulnerability disclosure policy via GitHub Private Vulnerability Reporting.
• llms.txt: Standardized machine-readable API overview and package map following the llmstxt.org specification.
• .gitignore & .gitattributes: Comprehensive ignore rules for test binaries, coverage, profiles, and OS/IDE metadata; LF line ending normalization and archive export-ignore rules.
• README.md & AGENTS.md: Synchronized workflow status badges, links to contributing and security guidelines, and updated verification checklists.

Verification

• gofmt -s -w . passed with 0 unformatted files.
• go mod tidy && git diff --exit-code go.mod go.sum verified clean.
• go test ./... passed across all 15 packages.
• go vet ./... and revive -config revive.toml ./... passed with 0 issues.
• govulncheck ./... reported no vulnerabilities.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.