chore: project hardening — dep swap, CI gates, dependabot, action bumps (#8)

* chore: project hardening — dep swap, CI gates, dependabot, action bumps

- swap gopkg.in/yaml.v3 (upstream archived Apr 2025) for maintained
  github.com/goccy/go-yaml; same Unmarshal API, tags unchanged
- add CI workflow: go vet/test/build + golangci-lint + govulncheck
  on PRs and main pushes
- add dependabot for gomod + github-actions (weekly)
- bump actions to latest majors in update.yml (clears Node 20
  deprecation annotations); workflow logic untouched
- README/history refreshed by E2E verification run (29 agents)

* fix: check Close/Remove error returns (errcheck)

Write paths (writeSnapshots, renderReadme) now propagate close errors —
a failed close there can hide lost data. Read/cleanup paths ignore
explicitly with _ =.

github.go

@@ -194,7 +194,7 @@ func doWithRetry(token string, body []byte) ([]byte, int, error) {
 		}
 
 		raw, err := io.ReadAll(resp.Body)
-		resp.Body.Close()
+		_ = resp.Body.Close() // body fully read (or read failed); close error is not actionable
 		if err != nil {
 			lastErr = fmt.Errorf("read body: %w", err)
 			continue