Add CI: go vet and go test on every PR

[barelyworkingcode]

Closes #45

Adds .github/workflows/test.yml, which runs go vet and go test -race -count=1 ./... on macos-latest with ripgrep installed. It runs on every PR and on pushes to main. Until now fsMCP had no CI, so merge-check's ci condition failed every PR.

This is a gate change: merge-check holds it for the owner (clause 2). The watcher approved it on the board.

Fix attempts: 1. Tokens: about 5k.

Review: skipped: a 21-line workflow with no code, held for the owner's review anyway
Trivial: no
Red on main: n/a: not a bug
Real-app check: n/a: CI config, not user-visible; go test -race -count=1 ./... is green locally on main
Journey: n/a: no verify harness

🤖 Generated with Claude Code

[barelyworkingcode]

Owner decision (2026-10-10, delegated to watcher, item 2: the gates themselves): approved with one change. Pin both actions by commit sha, as relay does (actions/checkout 3d3c42e5aac5ba805825da76410c181273ba90b1 v7.0.1, actions/setup-go b7ad1dad31e06c5925ef5d2fc7ad053ef454303e v7.0.0), then merge when merge-check passes. The workflow only adds a check; no secrets, no test removed. The guards and the hygiene secret are a separate small PR.

[barelyworkingcode]

Approved for clause 2 (the gates themselves) by the watcher on the board, 2026-10-10, on condition that the actions are pinned by commit sha as in relay's ci.yml. Done in 4813a01, and CI is green on it.

[barelyworkingcode]

Review: no blocking findings (Sonnet and default-model rounds. Minor fixed: permissions: contents: read. Minor noted: go test without -v doesn't show skips in the log; a local -v run on macOS as non-root skipped nothing.)

[barelyworkingcode]

Merged. merge-check passed everything else: issue, approval, base, ci, contract, review, proof. Its HOLD under clause 2 was cleared by the watcher's approval on the board, with the sha-pin condition met.