ci: add dedicated govulncheck issue-tracking workflow on main

[Copilot]

govulncheck findings were blocking PR merges in CI even when vulnerabilities were pre-existing and unrelated. This PR separates vulnerability tracking from PR gating by adding a dedicated workflow that runs on main and manages a single lifecycle-tracked issue.

• Workflow scope and triggers

  • Added .github/workflows/govulncheck.yml
  • Triggers on:
    • push to main
    • nightly schedule
    • manual dispatch (workflow_dispatch)
  • Uses global concurrency to prevent race conditions during issue management.

• Vulnerability detection behavior

  • Runs govulncheck -test -json ./...
  • Accepts expected govulncheck exit semantics (including findings) while still failing on unexpected execution errors.
  • Detects findings from JSON output and branches workflow behavior accordingly.

• Automated issue lifecycle (deduplicated)

  • Ensures govulncheck label exists.
  • Finds existing open tracking issue by label + exact title match.
  • If findings exist: create or update that single issue using --body-file.
  • If findings are cleared: auto-close the existing tracking issue with a resolution comment.

• Repository convention alignment

  • SHA-pinned actions.
  • ubuntu-24.04.
  • actions/checkout with persist-credentials: false.
  • Uses existing Task/Go setup patterns used by current workflows.

concurrency:
  group: govulncheck-issue-tracker
  cancel-in-progress: true

env:
  ISSUE_TITLE: "govulncheck: vulnerabilities detected on main"
  ISSUE_LABEL: govulncheck

[maniSbindra]

looks good. The failing govulncheck is not due to this PR but in main