ci: add the check that makes "all green" mean something (#27)

[linhdmn]

Closes #27.

This repo had no .github/ directory at all. The only thing that ran on a pull request was the gitStream app, which reports skipping — so every "tests pass" claim in #24/#25/#26 meant a human ran go test ./.... PRD §13 marked M6 closed with "deploys blocked on the full-suite gate" and §13.1's move 8 makes the eval suite the deploy gate. Neither was enforced by anything. That is now a check's verdict, not a sentence in a PR description.

What runs on every PR

Job	Steps
build-test	gofmt check → go build → go vet → go test ./... -count=1 → golangci-lint
prd	python3 docs/check-prd.py and --selftest

--selftest is in there deliberately: it asserts the checker can still fail, which is what stops check-prd.py rotting into a script that always prints OK. It had already rotted once — it could not run at all until #29.

make check now runs the same five steps locally, so a green local run and a green CI run mean the same thing. make fmt-check was verified to fail on a deliberately unformatted file, not just to pass on a clean tree.

Getting lint to a clean baseline found real defects

Not style — three of these are bugs:

• currentTier (LoopRunner) was dead. Written by nothing, read by nothing; RunResult.CurrentTier is the field that actually carries the tier.
• maxLandmarkTokens was a 20% budget nothing enforced. internal/memory's own comment claimed landmarks' "cap makes this unreachable" — that cap was the unused constant. Deleted rather than documented: landmarks are never evicted by design (P32), so a threshold for them is a number no code could honour. What it costs is now §9.1's fourth accepted ceiling: the 70% rule is a working-tier guarantee, not a whole-store one, because enforceCeiling() stops rather than evict a landmark.
• Unchecked writes in the HTTP layer. json.Encoder.Encode, the SSE/console fmt.Fprintf, and http.ListenAndServe now go through writeJSON/writeConsole, which log the failure — a broken client cannot be told (headers are already sent) but it should not be silent.
• Plus m4_test.go's defer cp.Close() and the two HTTP clients' resp.Body.Close().
• Categorize's switch → tagged switch (staticcheck QF1002); behaviour-identical.

.golangci.yml

Pins the linter set so CI and a local run agree, and states its one exclusion: errcheck inside _test.go, where defer resp.Body.Close() is conventional and its failure mode is a test that fails anyway. Production code gets no exclusion — those were fixed instead.

Also

.gitignore: the bare agentloop pattern needed its !cmd/agentloop/ un-ignore (it was listed twice, which is what the duplicate was for — one line with the reason beats two without).

Verification

• make check green: gofmt clean, vet clean, 13/13 packages, lint 0 issues, PRD OK, selftest 12/12.
• The workflow itself runs on this PR — this is the first PR in this repo where CI is the evidence.

Not in this PR

The eval endpoint is still not called by CI. The gate is "a green suite", not "a passing suite" — wiring GET /admin/api/v1/evals into the workflow is the M6 follow-through, and the PRD's M6 row says so rather than claiming otherwise.