docs: plan for running every test on every platform - #374

The plan for issue #373. The unit suite runs on ubuntu-latest only: 121
packages there, and exactly one test on macOS and Windows, since the
three-platform scenario job runs `go test -run TestWritDeployScenario
./cmd/writ` and nothing else.

Three rulings are recorded. The race detector runs on every leg, not Linux
only. The matrix job lands non-blocking so triage gets real data without
halting branches in flight, with a mandatory phase that removes
continue-on-error and makes the legs required. quality-gate stays on
ubuntu-latest — macOS bills at 10x and the shell-lint step installs shellcheck
via apt.

That last ruling exposed a second gap the plan now covers. go vet and
golangci-lint both honor build constraints, so choosing a platform for
quality-gate does not make it analyze the whole tree — it only changes which
files are skipped. Verified with go list: in pkg/platform, ubuntu sees
detect_linux.go and linux_managers_linux.go while detect_darwin.go,
darwin_managers_darwin.go, detect_windows.go and windows_managers_windows.go
are invisible. The real Darwin package manager is never linted on CI; its
non-Darwin stub is. Ten platform-gated files are unvetted and unlinted on every
pull request, and their only compilation anywhere is make dist's cross-compile
on release tags. Phase 1b adds per-GOOS vet, lint, and build sweeps — three
invocations on the one ubuntu runner, no additional cost.

Two facts reduce the risk materially. test-scenario depends on build, which
depends on generate, so the existing scenario job already runs the full
codegen chain on all three platforms and is green; test-race inherits a
prerequisite chain that is already proven. And TestWritDeployScenario is
symlink-based deployment passing on windows-latest, so symlink creation works
on that runner.

Measured risk across the test tree: 66 hardcoded /tmp, /usr, /etc or /bin
references; 66 permission-bit assertions; 14 expected values containing forward
slashes; 9 test files calling os.Symlink; 6 shelling out; 2 already skipping on
Windows; and zero runtime.GOOS == "windows" branches in production code. That
zero matters most — the codebase carries no Windows runtime branching at all,
so whatever the matrix surfaces is real behavior rather than an absent
conditional.

Phase 2 classifies every failure into exactly one of three buckets: a genuine
platform defect, a Unix-assuming test, or a test whose subject only exists on
one platform. The third moves into a build-tagged _linux_test.go file, which is
scoping rather than skipping. A t.Skip added to turn a leg green is bucket one
or two in disguise.

Documentation only; no code changes.
Issue: #373