feat: add go checker group

[emersonknapp]

One hook covers Go formatting, linting, and module tidiness:
golangci-lint fmt, golangci-lint run, and go mod tidy -diff.

golangci-lint has no PyPI wrapper and upstream discourages go install, so the hook downloads the pinned 2.13.2 release tarball on first use into sys.prefix/polymath-go.
That directory belongs to the pre-commit-managed virtualenv, so the download is scoped to one hook revision, shared across every consuming repo on the machine, and never lands in a consuming repo's tree.
The tarball is verified against a sha256 pinned in source for each of the four supported platforms, taken from the release's own checksums file, so trusting the download costs no second network fetch.
An exclusive flock serializes the install, since pre-commit runs one hook over several batches of files in parallel. Downloading a binary at first use has precedent here: hadolint-py and shellcheck-py do the same at install time.

The Go toolchain itself stays a prerequisite. golangci-lint type-checks by compiling, so bundling a binary would not remove the requirement, and any repo with a go.mod already has developers with Go installed. When go is absent the group returns a single failed result pointing at go.dev/dl, ahead of the pile of downstream noise a missing compiler produces.

The linter set is golangci-lint's standard default (errcheck, govet, ineffassign, staticcheck, unused) plus errorlint, misspell, revive, and unconvert, with gofumpt and goimports as formatters. Polymath has no internal Go precedent to inherit, so this follows community practice. Adding linters later is a minor version bump.

golangci-lint works on packages and must run from a module root, so staged files are grouped by their nearest ancestor go.mod and collapsed to package directories, each group run with cwd at its module root. run() gains an optional cwd for this. The config sets run.relative-path-mode: wd, since golangci-lint's default renders reported paths relative to the config file, and this config ships inside the hook's virtualenv.

Vendored sources are dropped from the grouping. run on a vendored package dir exits 7 with "not a package listed in vendor/modules.txt", and fmt would rewrite third-party code the consumer cannot fix.