chore: project hardening — dep swap, CI gates, dependabot, action bumps (#8)

* chore: project hardening — dep swap, CI gates, dependabot, action bumps

- swap gopkg.in/yaml.v3 (upstream archived Apr 2025) for maintained
  github.com/goccy/go-yaml; same Unmarshal API, tags unchanged
- add CI workflow: go vet/test/build + golangci-lint + govulncheck
  on PRs and main pushes
- add dependabot for gomod + github-actions (weekly)
- bump actions to latest majors in update.yml (clears Node 20
  deprecation annotations); workflow logic untouched
- README/history refreshed by E2E verification run (29 agents)

* fix: check Close/Remove error returns (errcheck)

Write paths (writeSnapshots, renderReadme) now propagate close errors —
a failed close there can hide lost data. Read/cleanup paths ignore
explicitly with _ =.

.github/workflows/update.yml

@@ -35,9 +35,9 @@ jobs:
       name: github-pages
       url: ${{ steps.deploy.outputs.page_url }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version: 'stable'
           cache: true
@@ -88,15 +88,15 @@ jobs:
       # site/data.json was generated by the updater run above; deploy the
       # static dashboard (site/) to GitHub Pages every run.
       - name: Configure Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@v6
         with:
           enablement: true
 
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: site
 
       - name: Deploy to GitHub Pages
         id: deploy
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5