fix(ci): read the toolchain directive, run -race per PR, bump otel (agent-os-7tl)

[thinkbig1979]

Acts on an independent QC review of the two session-1 commits. Nothing merged was broken; nothing is reverted.

The one that matters

Both workflows resolved the Go version with grep '^go ' backend/go.mod, which returns 1.25.0 — the go directive, not the toolchain go1.25.12 line below it. setup-go therefore installed 1.25.0, and the step was even named "Set up Go 1.25.0".

CI did still compile against 1.25.12. GOTOOLCHAIN defaults to auto, so the go command silently re-execs into the pinned toolchain — visible on PR #6's cache-miss run:

Set up Go 1.25.0   GOTOOLCHAIN='auto'
Build              go: downloading go1.25.12 (linux/amd64)

So there was no live exposure. But nothing in the workflow expressed that and nothing enforced it: GOTOOLCHAIN=local anywhere would have quietly reverted CI to go1.25.0 and reinstated GO-2026-5856 with no failing check.

go-version-file: backend/go.mod reads the toolchain directive directly and prefers it over the go directive. A go version step now records what actually compiled.

Also

• docker/Dockerfile joins backend.yml's paths filter. It holds one half of the Go version lockstep, and a Dockerfile-only drift previously triggered no backend job at all — the exact drift the lockstep exists to prevent.
• -race moves to every PR. The nightly decision rested on an estimate of 4-6 minutes; measured on the first real run it is 101s for the step, 119s for the job, against 39s for unit. It runs concurrently, and integration.yml takes ~4.5min on the same PR, so it is not on the critical path. Removes the schedule trigger and both if: gates.
• otel v1.41.0 → v1.42.0, clearing GO-2026-5158. Not reachable, but the previous commit's own rule — take the higher patch carrying further security work — was applied to go-git and go-billy and not to otel.

Three comments that stated things the evidence contradicts

• The -race cost figure above.
• manualremote_test.go claimed to exercise go-git's worktree.Status. It does not — agent-os-r1a kills the go-git path on every real clone, so everything below step 2a is served by the git CLI. The header now says so and lists what is never executed; step 2a asserts the go-git surface that is reachable (openRepo, repo.Head) so the file carries an honest non-zero claim; the behind-count is derived from git rev-list instead of loosened to >= 1.
• integration.yml claimed build+vet is what catches a build-constraint leak. True for internal/integrationtest/, whose harness is a non-test file behind the tag. False for internal/truth/ — those integration tests are self-contained, vet clean, and pass on a Docker-equipped runner. What catches them is backend.yml's Docker-free go test.

Gates: build, vet, 657 tests across 9 packages, govulncheck back to the same 3 unfixable docker/docker advisories, manualremote harness green on HTTPS and SSH.

What to look for in this PR's own checks: the Go setup step should name 1.25.12, and Race detector should run on a pull_request event.

Closes agent-os-7tl.

🤖 Generated with Claude Code