Standardize tooling - #12

The repositories must not use golangci-lint. Static analysis runs
through the Go tools declared in `go.mod`. This file configured only
golangci-lint, so no task reads it.

Resolve `go` to the latest release, as the other repositories do, and
refresh `mise.lock` to record the resolved version.

Resolve each `go tool` dependency to its latest release. The newer
constable reports a compound conditional in `isGitVersionArg`, so
rewrite that check as an early return, as `isVersionArg` already does.

Use hk for Git hooks, as the other repositories do. The hook
configuration lives in `hk.pkl`, and `mise run setup` installs it.
Remove the Lefthook tool and its module dependencies, because no
Lefthook configuration exists in this repository.

Add the tools that `hk check` runs, and refresh `mise.lock`. The
refresh also drops lock entries for tools that `mise.toml` does not
declare.

Name the mise tasks after hk's commands: `fix`, `check`, and `test`.
`check` runs `hk check --all` before the lint tasks, as the other
repositories do. Rename `ci-tests` to `ci-test`, and remove the
`fixers`, `linters`, and `tests` names and their aliases.

hk builtins call a bare tool name, such as gofumpt. Declare those tools
in mise.toml so PATH provides them, and the hk steps can use the
builtins without a wrapper.

Set minimum_release_age to 0 so that latest resolves constable to
0.5.0 and not to the hidden 0.4.0.

Take testifylint from the nnutter fork, which builds with Go 1.27 and
analyzes these modules. The upstream release cannot. The fork has no
tags, so latest resolves a pseudo-version, and that needs the
release-age setting at 0.

The next change uses the builtins of hk-config, which require hk 2.10.0.
This commit only moves the pin, so the older hk.pkl must still pass.

The hand-written steps repeated the commands that mise tasks already
run, so a change to a flag had to be made in two places. The builtins
hold those commands in one place and keep the file short. hk-config
supplies the steps that hk does not ship.

Declare the steps at top level. hk then creates the check, fix, and
pre-commit hooks, and this repository needs no hook of its own.
gitleaks scans the working tree through its builtin, so the shell
command that copied the staged files is gone.

Take go_fix and gomod_tidy from hk instead of the wrappers: their fix
commands rewrite the module and stage go.mod and go.sum.

Call hk from the mise tasks, so every step has one definition. `mise
run fix` fixes every file, and a supplied file list narrows it. CI
runs `mise run check` alone, because `hk check --all` runs every fixer
in check mode and fails when one would change a file.

Remove the go.mod tool directives, because mise provides those tools.

mise 2026.8.5 has no `hk` in its tool registry, so `mise install
--locked` fails before any step runs. mise 2026.10.21 resolves `hk`
through packslip, which is the backend `mise.lock` records.

Move jdx/mise-action from v4.2.5 to v5.2.5 and
actions/create-github-app-token from v3.2.0 to v3.3.0. A full commit
SHA plus a trailing tag comment keeps the pin reviewable: the comment
names the release, and the SHA cannot change under it when a tag moves.

The latest mise release is 2026.10.25, so 2026.10.21 is stale.

mise-action v5 defaults minimum_release_age to 24h. An explicit
`version` input skips that delay, so no other input changes.

A pinned image keeps the run reproducible: `ubuntu-latest` and
`macos-latest` move to a new image without a change in this repository,
so a compiler or toolchain change can break a build that nothing here
touched.

The `coverage` task writes `coverage.out` and `coverage.html`, and the
file ignored neither, so a fix run left both untracked.

Rename `concurrency.group` to `update-tap`, so all three repositories
use one name and a group is easy to find across them.

Pin `runs-on` to `ubuntu-26.04`, so the run does not move with the
`ubuntu-latest` image.

`permissions: {}` and the single tag `grep` stay as they are.

State the toolchain that mise installs, as the other two repositories
do, so `go mod tidy` and the linters agree on the language version.

Use the same entries, in the same order, as the other two
repositories. `.idea/` describes one editor, so the repository does not
list it. `tmp/` covers the scratch directory that the fixers and tests
leave behind.

An agent that fixes, tests, and checks before it starts begins from a
known state. The stop task narrows the fix to the files the agent
edited, so a long session does not rewrite the whole tree.

Reorder the `[tools]` keys and the top-level `steps` into one ASCII
order.

Sorting changes no behavior. It only makes the entries easier to find,
and it gives a new entry one obvious place.

Let an agent recognize the dotfile workflow without reading the
repository first. `roam` is not a Git alias, so an agent that reaches
for `git` on an untracked dotfile makes a second repository.

`cover` repeated the `coverage` task name, and the other two
repositories keep one name per task. Remove the alias so all three
read the same way.

Two problems passed every other check: a file that ends without a
newline, and a line that ends with spaces. Both are invisible in a
diff, so a reviewer cannot catch them.

`hk fix --all` with these steps rewrote no file, so this commit adds
the steps alone.

Rename `gosec` to `go_sec` and `govulncheck` to `go_vuln_check`, so
each step name matches the builtin it calls, as the constable
repository does. A step name that differs from its builtin makes the
step harder to find.

Drop the two section banners, and shorten the `setup` description, so
the three task files read the same way.

The release adds the `skills_ref` builtin, which the next commit uses.

The hand-written `lint-skills` task ran a pinned `uvx` command, so it
carried its own copy of the validator invocation. The `skills_ref`
builtin runs `agentskills validate` on every `SKILL.md`, which keeps
the command in hk-config with the other steps.

Add `agentskills-tools` from PyPI for the `agentskills` command.