Consolidate Goss and Image test workflows into unified workflow

[Copilot]

Description

Consolidates goss-test.yml and test-image.yml into a single test-unified.yml workflow, reducing maintenance overhead and improving test coverage consistency across all variants.

Changes:

• Workflow consolidation: Merged two overlapping test workflows into one with parallel matrix execution
• Enhanced coverage: Goss validation (base variant) + 7 sanity test categories across all 5 variants (base, minimal, python, node, full)
• Structured reporting: JSON + Markdown test summaries with artifact upload
• Future-ready: Matrix strategy prepared for multi-architecture builds (arm64)

Test categories (all variants):

1. Universal directory structure validation
2. XDG environment variable compliance
3. Permission verification (vscode user)
4. Locale configuration
5. Fundamental tools availability
6. Command suite smoke tests
7. Non-root user verification

Documentation updated:

• .github/copilot-instructions.md
• CONTRIBUTING.md
• docs/architecture.md, docs/variants.md, docs/security/privileged-mode.md
• tests/goss/README.md, variants/README.md

Metrics:

• Workflows: 13 → 12 (-7.7%)
• Lines: -57 net (consolidated logic)
• Test coverage: Enhanced with consistent validation across variants

Type of Change

• 🐛 Bug fix (non-breaking change which fixes an issue)
• ✨ New feature (non-breaking change which adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
• 📝 Documentation update
• 🔧 Configuration change
• ♻️ Code refactoring

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings or errors
• I have tested my changes locally

Version & Changelog

Important: When making changes to the base image, version, or functionality:

• I have updated the VERSION file if this is a breaking change or new feature
• I have updated the CHANGELOG.md under the [Unreleased] section with:
  • A description of my changes in the appropriate category (Added, Changed, Deprecated, Removed, Fixed, Security)
  • Reference to related issues (if applicable)

Note: No version or changelog update required - workflow consolidation does not affect image functionality or API.

Related Issues

Addresses workflow consolidation recommendations from audit findings.

Additional Context

All actionlint/shellcheck validations pass. Code review completed with no issues. The unified workflow maintains full backward compatibility while reducing CI complexity.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Consolidate Goss Tests and Image Tests into a Unified Workflow</issue_title>
<issue_description>TITLE: 🧹 Consolidate Goss Tests and Image Tests into a Unified Workflow

BODY:

Summary

The audit found that goss-test.yml and test-image.yml overlap significantly, increasing maintenance burden and workflow complexity.

Goal

Create a single, unified test workflow that:

• Builds all variants
• Runs Goss validations
• Performs additional sanity checks
• Uploads structured test reports
• Supports both amd64 and future arm64 builds

Improvements Expected

• Reduced workflow count (target: 8–10 workflows)
• Faster CI
• Clearer test pipeline
• Easier maintenance long-term

Acceptance Criteria

• Redundant workflows replaced with consolidated test suite
• All previous validations preserved
• Documentation updated to reflect new workflow structure

Labels

ci-cd, testing, refactor, workflow-consolidation, high-priority
</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Consolidate Goss Tests and Image Tests into a Unified Workflow #74

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.