ci: enforce >=90% line coverage on go_test targets

[tinder-maxwellelliott]

What

Adds coverage enforcement for go_test targets. Go production code under tools/go/ is now held to a 90% line-coverage bar, enforced in CI — gated independently of the existing Kotlin gate so thin coverage in one language can't hide behind well-covered code in the other.

This is groundwork for Go tooling landing under tools/go/ soon; the enforcement is live today against a sample target.

How

The existing LCOV checker (tools/coverage_check.py) is already language-agnostic — it scopes a combined LCOV report by path prefix. rules_go emits workspace-relative SF: paths (tools/go/.../*.go), so the gate is just a second invocation of the same binary with a Go-scoped --include.

• MODULE.bazel — add rules_go 0.60.0 + gazelle 0.45.0 + a hermetic Go SDK (go_sdk.download(version = "1.23.1")), all dev_dependency = True (matching the existing rules_python/rules_nodejs pattern) so module consumers don't inherit them via MVS. Versions match the nested go_mod_change test-resource workspace.
• tools/go/sample/ — a tiny go_library + go_test (100% covered) that exercises the gate end-to-end and keeps it green until real Go code lands. Replace/extend with real code under tools/go/.
• .github/workflows/ci.yaml — include //tools/go/... in the bazel coverage run; add an "Enforce Go coverage threshold" step running //tools:coverage-check -- --include tools/go/ --threshold 90.
• Makefile + README.md/tools/readme_template.md — mirror and document the Go gate locally (make coverage now runs both gates).

Validation

• bazel coverage //tools/go/... emits SF:tools/go/sample/sample.go — confirmed the tools/go/ prefix matches and cleanly excludes the Python tools/coverage_check.py.
• Go gate: 100% (8/8) PASS at threshold 90, evaluated independently of Kotlin.
• Buildifier: new BUILD/MODULE files already formatted (no changes).

Notes

• The Go gate exits non-zero if tools/go/ ever contains zero instrumentable Go code ("no instrumented production-source lines"). The sample prevents that — keep at least one real Go target under tools/go/.

🤖 Generated with Claude Code