v0.1

Pipeline Tools: govulncheck images, actions, and CI

Security and quality tooling packaged for CI. Ships govulncheck as
multi-arch full / slim / offline container images and reusable GitHub
Actions, built and verified through a split-workflow pipeline.

- Triggers (pr / push-main / release / vulndb) over reusable ci-* units
  (build, test, lint, secret-scan, offline) and composite actions
  (govulncheck, govulncheck-eval, go-version, go-setup-cache).
- Go toolchain version sourced from go.mod as the single source of truth,
  so Dependabot can roll it forward in one place.
- Offline image bundles the Go vulnerability database for air-gapped use,
  refreshed only when the database changes (rolling latest-slim-offline).
- Drift check (native vs full vs slim) guards releases and validates the
  offline image air-gapped before publish.
- SBOMs generated with Syft (no data egress) and attested on every image;
  also baked into the offline image.
- Dependabot daily (gomod + github-actions) with guarded auto-merge;
  pinned third-party actions; gitleaks, hadolint, shellcheck, actionlint.
- Docs: README, MIT LICENSE, THIRD_PARTY_LICENSES (incl. CC-BY-4.0 vuln DB
  attribution), version + image-size badges.