[CI] Add broad Go vet and fuller Staticcheck coverage before v1 stabilization

[cssbruno]

Priority

Medium — earlier detection of bad code patterns and public API regressions.

Context

The repository has a strong CI surface, including multi-platform tests, vulnerability checks, parser fuzz smoke, generated app integration, generated output determinism, docs checks, and focused dead-code/staticcheck coverage.

The current general Go module test script runs go test ./.... The focused dead-code script runs Staticcheck with -checks=U1000 on a selected package set, not a fuller analyzer pass over the root module and nested modules.

Problem

Important classes of maintainability and correctness issues may not be gated consistently:

• broad go vet ./... findings outside selected docs-site paths;
• Staticcheck correctness, simplification, API misuse, and performance diagnostics beyond U1000;
• nested module drift;
• accidental broad suppressions or package exclusions becoming permanent.

This is especially important because GOWDK is compiler/runtime infrastructure with many generated-code and public-contract boundaries.

Proposed direction

Add a staged static-analysis policy:

1. run go vet ./... for the root module and selected nested modules;
2. run Staticcheck with a reviewed baseline over the root module;
3. expand nested module coverage over time;
4. document temporary suppressions with reasons and expiry/issue links;
5. keep focused U1000/deadcode checks if they catch a different class of issue.

Acceptance criteria

• CI runs go vet ./... for the root module.
• CI runs go vet ./... for nested runtime/addon modules where practical.
• Staticcheck runs more than U1000 on at least the root module or a documented expanding package set.
• Any excluded packages or checks have issue-linked justification.
• Static-analysis scripts are documented in docs/engineering/ci.md.
• CI failure output is actionable and does not require local guesswork.

Related

• Define and enforce the v1 core versus optional product boundaries #677 — v1 core/product boundary
• Extract shared project compilation orchestration from the CLI #671 — shared compiler/application services