ci: add CI gates for codegen drift, Go build, and Go unit tests #2499

Problem

PR CI currently runs Helm/BATS unit tests, builds Docker images, and runs E2E tests, but does not validate three Go-related concerns. PR #2466 illustrated all three:

1. Codegen drift: the PR modified api/apps/v1alpha1/postgresql/types.go (replacing a typed sub-struct with map[string]string) but make generate was not run. The orphan PostgreSQLParameters DeepCopyInto/DeepCopy methods left in zz_generated.deepcopy.go broke the package with three undefined: PostgreSQLParameters errors. CI did not flag this — code review did.
2. Go build: make build (in pull-requests.yaml Build job) only builds Docker images and cmd/cozypkg. There is no go build ./... for the root module or for the other modules in the repo (api/apps/v1alpha1/, packages/apps/kubernetes/images/kubevirt-csi-driver/, packages/system/dashboard/images/token-proxy/, packages/system/kubeovn-webhook/images/kubeovn-webhook/). A broken submodule only fails compilation when something else imports it.
3. Go unit tests: make unit-tests only runs helm-unit-tests.sh and bats-unit-tests. There is no go test ./... for any module.

The pre-commit config (.pre-commit-config.yaml) does declare a run-make-generate hook, but the workflow (.github/workflows/pre-commit.yml) only feeds *.yaml and *.md files into pre-commit run --files, so the generate hook never executes in CI.

Proposal

Add a new workflow (e.g. go-checks.yml), triggered on pull_request, with three jobs:

1. Codegen drift gate:

   make generate
   git diff --exit-code

   Fails if make generate produces any change.
2. Go build gate — go build ./... for the root module and each submodule listed above (or via go work if a workspace is appropriate).
3. Go unit tests gate — go test ./... for each module above.

The job should run independently of the heavy E2E pipeline so contributors get fast feedback on code-level regressions that today only surface in review or once the cluster install fails.

Out of scope

• Helm chart linting / values.schema.json drift (separate hardening; existing pre-commit workflow already lints YAML & Markdown).
• Coverage reporting.

References

• Workflow inventory: .github/workflows/{pull-requests.yaml,pre-commit.yml,retest.yaml}
• Codegen entry point: Makefile:121 → hack/update-codegen.sh
• Pre-commit hook (declared, not run in CI): .pre-commit-config.yaml:1-15
• Recent example this would catch: feat(postgres)!: support all PostgreSQL configuration parameters #2466 (commit 7144d893)