Harden Go agentic development tooling

[jooh]

Summary

• pin Go 1.26.5 and gopls v0.23.0, and expose gopls through an optional project-scoped Codex MCP server
• add module-integrity and Go modernization quality gates to local CI and pre-commit
• add native fuzz targets for Markdown rendering, streamed Markdown chunking, and OpenResponses SSE parsing
• run fuzzing weekly and on manual dispatch, while keeping pull-request checks deterministic
• document the agent-oriented Go development workflow

Why

The repository already had strong deterministic tests, race detection, coverage, lint, and security checks, but it lacked several Go capabilities that make AI-assisted changes safer: semantic gopls access, explicit modernizer checks, module-cache verification, and sustained fuzzing of untrusted input boundaries.

During validation, govulncheck identified reachable issues in Go 1.26.4 and gRPC 1.81.1. This change upgrades them to Go 1.26.5 and gRPC 1.82.1.

Impact

Agents and developers get pinned semantic tooling and clearer evidence-based quality gates. The application architecture and runtime behavior are otherwise unchanged.

Validation

• make ci
• make fuzz FUZZ_TIME=2s
• 95.6% statement coverage
• zero reachable vulnerabilities
• zero gosec findings
• live gopls MCP initialization and workspace query