feat: add linter configs, Dockerfile, CI/CD pipeline

- .golangci.yml — 50+ linters enabled
- .yamllint — yaml lint rules
- cicd.yaml — CI/CD with lint-go (golangci, staticcheck,
  gosec, revive), lint-yaml, build+test, publish
- Dockerfile — multi-stage scratch build
- go vet passes clean

.golangci.yml

@@ -0,0 +1,108 @@
+run:
+  timeout: 5m
+  skip-dirs:
+    - vendor/
+
+linters:
+  enable:
+    - errcheck
+    - gosimple
+    - govet
+    - ineffassign
+    - staticcheck
+    - typecheck
+    - unused
+    - asciicheck
+    - bodyclose
+    - cyclop
+    - decorder
+    - dupl
+    - dupword
+    - durationcheck
+    - errname
+    - errorlint
+    - exhaustive
+    - forcetypeassert
+    - gochecknoinits
+    - gocognit
+    - goconst
+    - gocritic
+    - gocyclo
+    - godot
+    - goimports
+    - gomoddirectives
+    - gomodguard
+    - goprintffuncname
+    - gosec
+    - grouper
+    - ifshort
+    - importas
+    - lll
+    - makezero
+    - mirror
+    - misspell
+    - nakedret
+    - nestif
+    - nilerr
+    - nilnil
+    - nlreturn
+    - noctx
+    - nolintlint
+    - nosprintfhostport
+    - prealloc
+    - predeclared
+    - promlinter
+    - reassign
+    - revive
+    - rowserrcheck
+    - sqlclosecheck
+    - stylecheck
+    - tagalign
+    - tagliatelle
+    - tenv
+    - testableexamples
+    - thelper
+    - tparallel
+    - unconvert
+    - unparam
+    - usestdlibvars
+    - wastedassign
+    - whitespace
+    - wsl
+    - zerologlint
+
+linters-settings:
+  gocyclo:
+    min-complexity: 20
+  gocognit:
+    min-complexity: 30
+  lll:
+    line-length: 140
+  misspell:
+    locale: US
+  funlen:
+    lines: 80
+    statements: 60
+  revive:
+    rules:
+      - name: exported
+        severity: warning
+      - name: unexported-return
+        severity: warning
+  gosec:
+    excludes:
+      - G204 # subprocess launched with variables
+
+issues:
+  exclude-rules:
+    - path: _test\.go
+      linters:
+        - errcheck
+        - gosec
+    - path: main\.go
+      linters:
+        - gochecknoinits
+
+output:
+  formats:
+    - format: colored-line-number