fix(go-pr-validation): include ready_for_review in change gate condit...

fix: add Go PR validation and service release umbrella workflows (#406)
* fix: add Go PR validation and service release umbrella workflows
Introduce two umbrella reusable workflows so Go service repos reference a
single workflow per concern, plus the shared composites they build on.
- go-pr-validation.yml: orchestrates PR metadata, a non-doc change gate,
 go-pr-analysis and pr-security-scan behind opt-in flags, with stable
 aggregator status checks for branch protection.
- go-release.yml: reworked from the GoReleaser binary flow into a service
 release umbrella (semantic-release on branch push; build + gitops-update
 on tag push), gated by non-doc change detection.
- src/config/non-doc-changes: composite reporting whether a PR/push touches
 anything beyond docs/meta.
- src/validate/result-gate: composite exposing one stable status check over
 a multi-job reusable pipeline.
Docs, labeler and CONTRIBUTING updated. Additive on v1 - the previous
GoReleaser go-release content remains in git history.
* test(ci): pin umbrella composites to feature branch for end-to-end testing
Temporary: flip src/config/non-doc-changes and src/validate/result-gate refs
from @v1 to @feat/go-validation-release-umbrellas so the umbrellas resolve when
called from a caller PR before release. MUST be reverted to @v1 before merge.
* feat(go-pr-validation): add Lerian lib version check to the umbrella
Wire lerian-lib-version-check.yml into the PR validation umbrella as a gated
job (run_lib_version_check, default true), behind the non-doc change gate, with
a stable 'Lib Version' aggregator check for branch protection. Expose
go_mod_path / check_indirect / comment_on_pr inputs and the optional
LERIAN_LIB_READ_TOKEN secret.
* fix(lerian-lib-version): log non-200 HTTP code from releases API
* fix(lerian-lib-version): post PR comment even when check fails
* fix(umbrellas): pin composites to @v1 instead of feature branch

fix(lerian-lib-version): post PR comment even when check fails (#414)

fix(lerian-lib-version): log non-200 HTTP code from releases API (#413)

fix(lerian-lib-version): use MANAGE_TOKEN for PR comment in nested re...

fix(lerian-lib-version): retry releases fetch without auth on 404 for...

fix(go-pr-analysis): silence gosec telemetry 403 and make-sec noise (...

fix(ci): add shared_paths input to go-pr-analysis workflow (#405)
Mirrors the same input already present in pr-security-scan.yml.
Wires shared-paths through to the changed-paths action so monorepo
callers can trigger analysis for all components when shared files
(go.mod, pkg/, Makefile, etc.) are modified.
Default is empty string — fully backward compatible.
Closes #402