Align CI with xtractr and pin GitHub Action SHAs

[davidnewhall]

Summary

• Run tests on Ubuntu, macOS, and Windows with -race, and split golangci-lint by GOOS (darwin/freebsd vs linux/windows).
• Trigger on push and pull_request to main (not pull_request_target). Pin checkout, setup-go, and golangci-lint-action to the same SHAs as xtractr.
• Copy xtractr's Renovate config so Action digests stay pinned and non-major Go/Action updates can automerge.

Test plan

• Confirm the gotest matrix runs on macos, windows, and ubuntu
• Confirm golangci jobs run for darwin, freebsd, linux, and windows
• Confirm fork PRs get CI without repo secrets

Made with Cursor