ci: catch cross-platform build breaks, gofmt drift and untidy go.mod

CI builds one platform (linux/amd64) while release.yml ships six. The
repo has platform-gated source - shell_windows.go, procattr_windows.go
and their _unix twins - that CI never compiles, so a signature change to
shellCommand or configureProcessGroup compiles green on main and breaks
at tag time, after the tag is public.

Add a cross-compile matrix job covering the five targets the test job
does not, mirroring the shape release.yml:11-29 already runs on this
same runner pool. fail-fast: false so a failure names the target.

Also add two cheap gates the repo lacked: gofmt -s drift (make fmt
rewrites and can never fail CI) and go mod tidy drift (make check
mutates, so it cannot gate either). Both print the remedy.

All six targets build clean today - this is a missing guard, not a fix.

Author: chethanuk

.github/workflows/ci.yml

@@ -25,6 +25,24 @@ jobs:
       - name: Trust workspace
         run: git config --global --replace-all safe.directory '*'
 
+      - name: Check formatting
+        run: |
+          unformatted="$(gofmt -s -l .)"
+          if [ -n "$unformatted" ]; then
+            echo "::error::Not gofmt-clean. Run 'gofmt -s -w .' and commit:"
+            echo "$unformatted"
+            gofmt -s -d .
+            exit 1
+          fi
+
+      - name: Check go.mod is tidy
+        run: |
+          go mod tidy
+          if ! git diff --exit-code -- go.mod go.sum; then
+            echo "::error::go.mod/go.sum are not tidy. Run 'go mod tidy' and commit the diff above."
+            exit 1
+          fi
+
       - name: Vet
         run: go vet ./...
 
@@ -50,3 +68,27 @@ jobs:
 
       - name: Build
         run: go build -o /dev/null ./cmd/opencodereview
+
+  cross-compile:
+    runs-on: self-hosted
+    timeout-minutes: 20
+    container:
+      image: golang:1.26.5
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - {goos: linux,   goarch: arm64}
+          - {goos: darwin,  goarch: amd64}
+          - {goos: darwin,  goarch: arm64}
+          - {goos: windows, goarch: amd64}
+          - {goos: windows, goarch: arm64}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build ${{ matrix.goos }}/${{ matrix.goarch }}
+        env:
+          GOOS: ${{ matrix.goos }}
+          GOARCH: ${{ matrix.goarch }}
+          CGO_ENABLED: '0'
+        run: go build -o /dev/null ./...