ci: adopt shared xraph/workflows go-ci

[juicycleff]

Replaces the go and lint jobs with one call. The Makefile defines no
test/lint/vet targets, so the shared workflow's probe falls back to the same
plain go commands these jobs ran directly - and adds gosec plus govulncheck,
which this repo had no equivalent of.

format stays local: it uses goimports, which is stricter than go-ci's gofmt
check. docs stays local too.

Also gitignores .worktrees/ - a local git worktree with its own go.mod that
would otherwise be swept in by 'git add -A'.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.