refactor(parser): reimplement the parser in Go alongside the Rust crate

Adds go-parser/, a Go reimplementation of the xlsxread parser, verified
byte-for-byte against the Rust original before any cutover.

Reader fidelity is exact across all 299 input files: the canonical cell dump
of every sheet matches calamine's, locked in as a test against a committed
hash oracle. Reaching that required replacing extrame/xls, which corrupted
69% of cells and dropped a further 28% on the BIFF corpus, with pbnjay/grate;
correcting excelize's number-format application and trailing-cell trimming;
restoring carriage returns that XML line-ending normalisation strips from
2,233 ten_cum_thi values; and gating numeric re-rendering on cell type so
shared strings that merely look numeric keep their leading zeros.

The differential gate compares both parsers over all four datasets:
3,265,641 rows with identical full-table SHA-256, identical per-column
non-NULL counts, identical schema metadata and identical stdout.

Config moves from TOML to YAML for both parsers, so they keep reading the
same files and the gate stays meaningful. Verified by rebuilding 2016 and
2017-old2 with Rust under the new configs and matching the recorded counts.

build-db.js now refuses to publish a database whose row count does not match
the known figure, closing a path where an under-producing parser could ship a
truncated public dataset with green CI. The deploy workflow gains a
pull_request trigger and guards deploy to main, so branch verification can no
longer publish to production.

docs/deployment-guide.md

@@ -7,8 +7,8 @@ One-time setup: **Settings → Pages → Source: GitHub Actions**.
 
 ## What the workflow does
 
-1. Checkout, Rust toolchain, Node 24, `npm ci`
-2. `npm run build:rust` — one parser binary
+1. Checkout, Go toolchain, Node 24, `npm ci`
+2. `npm run build:go` — one parser binary
 3. `npm run build:db` — builds and gzips all four databases into
    `.build/public/db/`
 4. `npm run build:site` — one Vite build, then `scripts/assemble-site.js`
@@ -35,7 +35,7 @@ string intact.
 
 ```bash
 npm ci
-npm run build:rust
+npm run build:go
 npm run build:db      # all four; pass an id to build just one
 npm run build:site    # vite build + assemble into _site/
 npx serve _site
@@ -44,7 +44,7 @@ npx serve _site
 To rebuild a single dataset:
 
 ```bash
-node parser/scripts/build-db.js 2017-old
+node go-parser/scripts/build-db.js 2017-old
 ```
 
 ## Base path
@@ -56,9 +56,9 @@ up as a blank page with 404s on `/assets/...`.
 ## Adding a dataset
 
 1. Put the Excel files in `data/<id>/`
-2. Add `parser/configs/<id>.toml` with the parse rules — sheet mode, column
+2. Add `parser/configs/<id>.yml` with the parse rules — sheet mode, column
    indices, SBD validation, header tokens, blank-row stripping. No SQL: the
-   schema is canonical and lives in `parser/src/schema.rs`
+   schema is canonical and lives in `go-parser/internal/schema/schema.go`
 3. Add an entry to `DATASETS` in `src/datasets.js`
 
 Nothing else. The build script, the site assembly and the router all read that