feat(pre-commit-advisory): opt-in private-modules for Go module fetches

[blairham]

Why

Repos that fetch private pinpredict Go modules (ppkit) instead of vendoring can't run the pre-commit advisory job at all: the go-mod-tidy-repo and golangci-lint (typecheck) hooks fail with fatal: could not read Username for 'https://github.com' on the private module download. herald and covenant both dropped the job for exactly this reason, losing the advisory diff-scoped hook run + sticky PR comment on those repos — and understudy just hit the same wall when its feeds plugin added a ppkit dependency (understudy#47).

What

An opt-in private-modules boolean input, mirroring the one docker-release.yml gained in #26:

• When true: mint a short-lived read-only pinpredict-argocd App token (BOOTSTRAP_APP_ID / BOOTSTRAP_APP_PRIVATE_KEY via secrets: inherit), install a git insteadOf rewrite for github.com/pinpredict/, and export GOPRIVATE=github.com/pinpredict/* before pre-commit runs.
• Default false — completely inert for every existing caller (all pin @main).
• The token lives only in the runner-local git config; it never lands in the checkout or the hook-env cache.

Caller usage

  pre-commit:
    permissions:
      contents: read
      pull-requests: write
    uses: pinpredict/.github/.github/workflows/pre-commit-advisory.yml@main
    with:
      private-modules: true
    secrets: inherit

First consumer will be understudy (restoring the advisory job its feeds-plugin PR had to drop); herald and covenant can then restore theirs too.