ci: analyze every GOOS per pull request — vet, lint, and cross-compile sweeps - #388

…e sweeps

Phase 1b of issue #373. go vet, golangci-lint, and the compiler all honor
build constraints, so the single-GOOS quality-gate never saw the other
platforms' _darwin.go/_windows.go/_linux.go files: the real Darwin and Windows
package managers went unanalyzed while their stubs were checked, and a compile
error in a windows file would have surfaced at release, not at PR. New Makefile
targets vet-all, lint-all, and build-all run each analysis under linux, darwin,
and windows on the one runner; quality-gate wires them in place of the
single-GOOS vet and direct-lint steps, plus a cross-compile step.

The first local run earned its keep twice over.

GOOS=windows go vet failed to compile three test files (syscall.Umask in
pkg/op/default_funcs_test.go and pkg/op/provider/plan/deferred_default_test.go;
syscall.Stat_t in pkg/op/provider/file/provider_test.go). That is the cause of
a triage undercount on the windows test leg: those three packages reported
[build failed], which the FAIL-line counting never included — the standing "34
failures" excludes whatever their suites reveal once they run. The umask tests
now read through production's portable processUmask seam (a build-tagged
testProcessUmask pair for the external plan_test package), so they RUN on
Windows rather than being skipped; the chown test moves to
provider_unix_test.go, scoped because its subject — uid/gid ownership through
syscall.Stat_t — exists only on Unix.

The first-ever windows lint pass found 5 issues (linux and darwin: zero), all
fixed structurally rather than suppressed: statIdentity's windows variant gains
its unix twin's named results (inode, device); runShellCommand and its two
knobs move to pkg/platform/helpers_unix.go, because every consumer is
unix-gated and under a windows analysis they were dead code; captureRefresh
moves to update_unix_test.go for the same reason.

A full go-style compliance sweep of all 11 touched Go files rides along, per
directive: 17 multi-line doc summaries split to the single-line form, ~105
missing blank-after-signature lines inserted, 7 over-120-column lines rewrapped
or shortened, fixture struct members documented inline. The mechanical
detectors report zero findings; the one surviving >120 line is bracket's
signature, exempt under section 8. One error the sweep itself introduced — an
err := redeclaration from a hoisted tamper-guard call — was caught by vet and
fixed before commit.

Verified: gofmt clean over the change set; make vet-all, make lint-all, and
make build-all all green (the commit script re-asserts the first two before
committing); full make test green — zero FAIL or panic lines by count.
Plan: docs/plans/platform-test-matrix.md (phase 1b recorded).
Issue: #373