[joshjhall]

Summary

PR C of 3 for #811 — the port itself. lib/features/golang.sh no longer downloads, verifies, or extracts Go; it runs luggage install go@${GO_VERSION} against the vendored catalog.

• Prerequisites already merged: feat(luggage): add {arch} URL placeholder and catalog-declared version_args #1345 (luggage {arch} URL placeholder + catalog-declared Tool.version_args, needed because go --version exits 2) and feat(tools): add go catalog entry with binary-tarball install method containers-db#456 (the go catalog: 70 stable versions 1.22.0–1.27.3, one binary-tarball method each, tier-3 against dl.google.com's .sha256).
• Vendored catalog: crates/luggage/testdata/catalog/tools/go/ is a byte-identical mirror of containers-db 67f04700; just db-validate-vendored compares all 71 go entries, 0 drift.
• golang.sh: removed arch detection, curl, the 4-tier verify_download_or_fail flow, tar -xzf, the symlink loop, and four sourced helpers. Partial versions (1.26) resolve via luggage resolve go, read with an anchored sed (no jq — no base image installs it) and surfacing luggage's own stderr on failure. git stays an apt_install (runtime need of go get).
• Behavior changes, by design:
  • Go < 1.22 is refused up front with a clear message (the catalog floor), replacing a "continuing with installation" warning that could no longer succeed.
  • amd64/arm64 only, matching docs/reference/supported-platforms.md. The old armhf (armv6l) / i386 (386) arms covered platforms this project never built; luggage refuses them by name (no install method for go@X matches debian/armhf).
• Version updater: the Go arm now runs update_luggage_catalog "go" so auto-patch keeps the vendored catalog in lockstep with the pin.

Also in this PR (disclosed scope)

• Prerequisite — Rust MSRV in integration fixtures. Both luggage fixtures were on rust:1.98.0; the workspace MSRV is 1.99, so cargo build refused. The existing rust fixture was silently broken (weekly tier, unnoticed); the new go fixture can't build without the fix. tests/unit/rust-version-sync.sh now checks fixture builder images too (including --platform= / registry-prefixed spellings), so the next MSRV bump names them.
• Incidental — memory. Two lessons learned on this issue, folded into existing entries (no index growth): omitting diff for a cross-repo review reviews the cwd branch instead; and two new "test passes/fails for the wrong reason" cases (a fixture with no real decoy; a $(...) || rc=$? harness that disables set -e in the code under test).

Test plan

• just test-integration-one luggage_golang — 2/2 PASS on a real build: go1.27.2 linux/arm64; go/gofmt → /usr/local/go/bin; GOROOT=/usr/local/go; /cache/go, /cache/go-build, /cache/go-mod all owned by vscode; luggage log shows verify (tier 3); GO_VERSION=1.26 resolves to 1.26.10. Fixture installs no jq and passes golang.sh's real install flags.
• just test-integration-one luggage_rust — 1/1 PASS (confirms the MSRV fix).
• Unit, golang suite 22/22 — runs golang.sh's real version and install blocks against a stub luggage: partial resolve (with a nested-"version" decoy), exact pin skips luggage, failed resolve surfaces luggage's error, no-version fails closed, <1.22 refused, bare "1" rejected by validation, 2.0 reaches resolve, a failing install aborts the script, exact install argv.
• Every new test is mutation-killed on a scratch copy (loosened sed anchor, swallowed stderr, dropped empty-check, floor as warning, || true / || : / || echo, dropped --user / --cache-root, wrong catalog, Go updater "rust" / $current, respelled stale builder).
• cargo test --workspace, just test (0 failures), just db-validate-vendored (0 drift), shellcheck clean.
• Adversarial pre-PR review (ship-issue workflow.js harness): 5 cycles; cycle 1's five blocking findings fixed; final full-scope cycle clean, its in-scope test gaps fixed in this commit.

Follow-ups

• test(features): golang unit suite fidelity — drop tautological legacy tests; run real golang.sh in the luggage fixture #1346 — golang unit suite fidelity (pre-existing tautological tests; fixture runs real golang.sh)
• fix(luggage): bound the version-probe exec with a timeout #1344 — bound luggage's version-probe exec with a timeout
• feat(scanner): add a go adapter so new Go releases reach the catalog containers-db#455 — go scanner adapter (new patches arrive automatically)
• ci(evidence): build the evidence matrix for every luggage tool, not just rust #1341 — evidence matrix beyond rust
• test(validator): parse every version file as containers_common ToolVersion, tighten index-walk guard containers-db#457 — parse every version file as ToolVersion

Closes #811

🤖 Generated with Claude Code