ci: verify BASIC interpreter with existing hosted Go

[scottdensmore]

Summary

Add read-only build/test CI for PRs and main pushes using an existing hosted Go toolchain. Run the current formatting, vet, race-enabled tests and 80% coverage gate, bounded fuzz targets, pinned 112-variant corpus smoke tier, and CLI/cross-platform builds. Source code, tests, assertions, Makefile, and dependency versions are unchanged.

Behavior

Tests run on Linux; Linux, macOS, and Windows binaries are cross-compiled without packaging or publishing. Automatic Go toolchain/module downloads are disabled; the project has no external runtime modules. Only pinned BASIC corpus data is downloaded. No tools or runtimes are installed locally or on the runner, and no release publisher is restored. Dependency PR #127 is unchanged.

Validation

• Workflow actionlint with ShellCheck and whitespace checks passed locally.
• Hosted run39183017110 passed on exact head0ab939c4feb242730e35e3c92b9193b523a0b95f: Go1.26.9, formatting/vet, all race-enabled tests, 83.1% coverage against unchanged80% threshold, both10-second fuzz targets (610757 lexer and386584 parser executions), all112 pinned corpus variants, native CLI and5cross-platform builds, tracked-source preservation. No local application tests were launched.
• The optional golangci-lint and govulncheck gates require tool installation and are explicitly outside this workflow's coverage. make check and make vuln are not claimed.
• README documents actual coverage and limitations. Failure logs are retained for three days; generated binaries and BASIC data are not published.

Merge status

Merged after exact-head green validation and bounded CI merge approval, without bypassing branch requirements. Automatic main validation passed on current main b0a4517: https://github.com/scottdensmore/go-basic/actions/runs/39183361022.