feat(hawk): production hardening — adopt top-50 OSS patterns

[Patel230]

Summary

Production-hardening pass for hawk that brings the repo closer to top-50 OSS
repository standards. The branch contains two commits — a code-quality pass and
a re-baseline + OSS-hygiene pass — both targeting dev.

The mandate (per GOAL.md) is that hawk be the reference Go AI coding agent
for solo developers: fast, single-binary, zero-config, offline-capable. This
PR raises the floor on linting strictness, error correctness, CI signal, and
project-meta files without changing the existing package layout (a separate PR
will tackle layout migration if/when desired, since that touches every Go
import path).

Commits

1. feat(hawk): production hardening — linter, CI, errcheck, dead code removal
2. feat(hawk): re-baseline to v0.2.0 + OSS standards (CoC, PR/issue templates, .gitattributes)

---

What's in commit 1 — code-quality + infra hardening

Linting & code quality

• .golangci.yml — strict v2 config: errcheck, staticcheck, gocritic
  (diagnostic + performance), unused, ineffassign, misspell, noctx,
  bodyclose, unconvert, whitespace, with govet enable-all (minus
  fieldalignment).
• 240+ unchecked error returns fixed across session/, engine/, tool/,
  config/, cmd/, auth/, analytics/, cmdhistory/, container/,
  daemon/, diffsandbox/, eval/, fingerprint/, update/ and other
  production packages. Each fix wraps with context, ignores intentionally with
  a comment, or surfaces the error.
• Dead-code removal: 13 unused declarations removed (caught by the
  unused linter) — pruned in tool/smart_create.go, taste/collector.go,
  taste/detector.go, repomap/*.go, mcp/server.go,
  permissions/osv_checker.go, container/lifecycle.go, eval/coverage.go.
• Real bugs fixed: SA4010 (append result never used) in
  mcp/server.go and repomap/depgraph.go.
• session/ is now fully errcheck-clean — critical because session
  storage backs persistence/replay; silent error drops there mean lost user
  state.

Infrastructure

• Makefile — standard targets per GOAL.md: build, test,
  test-coverage, test-10x, lint, fmt, vet, security, bench,
  clean, install, release, help.
• .github/workflows/ci.yml — race-detector tests with coverage upload,
  golangci-lint v2 action, govulncheck and gosec security scans,
  multi-platform build matrix (linux/darwin/windows × amd64/arm64),
  benchmark job on PRs.
• Dockerfile — tini init system to handle zombies / signals
  correctly, timezone data embedded, go mod verify, runs as non-root
  hawk:1000.
• .editorconfig — consistent formatting (UTF-8, LF, 2-space YAML, tabs
  for Go) across editors.
• .github/dependabot.yml — weekly updates for gomod and
  github-actions.
• CONTRIBUTING.md — development setup, branch flow, conventional
  commits, test/lint requirements.

Test coverage

• auth/auth_test.go — 18.2% → ~70.5% with table-driven tests for
  TokenStore, SecureStorage, OAuthFlow, including edge cases
  (corrupted store, missing key, expired token).
• update/update_test.go — 22.2% → ~91.9% with httptest mocking and
  full error-path coverage (server failure, invalid JSON, unreachable host,
  Summary() rendering both states).

---

What's in commit 2 — version re-baseline + OSS standards

Version 0.2.0 across the repo

Aligns hawk with the rest of the hawk-eco ecosystem (eyrie, tok, yaad,
sight, inspect are all v0.1.0/v0.2.0). Updated:

File	Change
main.go	var Version = "0.2.0"
api/server.go	const Version = "0.2.0"
flake.nix	version = "0.2.0";
.github/workflows/release.yml	sister-repo clone branches v0.4.0 → v0.2.0 (5 sites)
api/server_test.go	current-version assertion → "0.2.0"
update/update_test.go	Check("0.2.0") / Summary("0.2.0") / TagName: "v0.2.0" (5 sites)

The semver-comparison table case {"dev version", "0.4.0", "0.3.9", true} in
update_test.go is intentionally unchanged — it tests isNewer()
comparison logic, not the current installed version.

CHANGELOG.md

• Added ## [Unreleased] at the top describing the re-baseline + the full
  hardening pass (both commits together).
• Existing 0.4.0, 0.3.0, 0.2.0, 0.0.1 entries preserved verbatim as
  historical reference.
• Adopted the standard Keep-a-Changelog header.

New OSS standard files

File	Purpose
.gitattributes	LF line-ending normalization, binary detection, GitHub linguist hints (collapse go.sum, mark *-research.md as documentation)
CODE_OF_CONDUCT.md	Contributor Covenant 2.1
.github/PULL_REQUEST_TEMPLATE.md	Summary / Changes / Testing / Checklist
.github/ISSUE_TEMPLATE/bug_report.yml	structured bug report
.github/ISSUE_TEMPLATE/feature_request.yml	feature request with solo-dev fit checks
.github/ISSUE_TEMPLATE/config.yml	routes security to advisories, questions to discussions, blocks blank issues

---

Verification

Check	Status
go build ./...	✅ clean
go vet ./...	✅ clean
go test -race -count=1 on api/, update/, cmd/	✅ pass
go test -race -count=1 on auth/, session/, config/, permissions/, mcp/	✅ pass
All modified Go files gofmt-clean	✅ yes

Known follow-ups (intentionally not in this PR):

• 253 pre-existing gofmt issues live in untouched files. A separate PR will
  do a repo-wide gofumpt -w . so the diff stays focused.
• Layout migration to cmd/hawk/main.go + internal/<feature>/ per GOAL.md
  is intentionally out of scope here — it would touch every Go import path
  across the ecosystem and warrants its own PR with coordinated SDK updates.

Test plan

• make build (or go build ./...)
• make test on impacted packages with -race
• go vet ./...
• CI on this PR will run lint, security scan, multi-platform builds,
  and benchmarks.
• CI passes (will verify after push)