Update go-v1 driver to spec 0005 vendored exceptions

[ivanopcode]

Context

curator-spec dce6643 (decisions/0005-vendored-go-boundary-relaxation.md + profiles/manager.md:2.3) documents four vendored exceptions for go-v1 closed pipeline. curator:rc3 124654a (internal/godriver/graph.go) implements narrow allowlists; skill-project-management vendoring x/sys, coder/websocket masks and generators now passes curator skill check + install.

cocoaskills:main (d2db86c, src/csk/builds/go_v1.py:852/1011) still enforces strict profile:

• SFiles exact reject
• //go:cgo_import_dynamic exact reject
• //go:generate as generator
• Root == GOROOT strict

Proposal

Port the same four vendored exceptions as узкие allowlists (not broad if false):

1. GOROOT/src/vendor packages with ImportPath prefix vendor/ and Root=="" accepted as trusted when Standard==true && Goroot==true and directory below GOROOT (Go 1.25 quirk)
2. SFiles allowed only for vendored non-standard packages with no CgoFiles/CFiles/etc/host objects, where every SFiles entry is regular file below build root and package is hashed via curator-build-source-v1 (pure Go assembly, e.g. coder/websocket masks)
3. //go:cgo_import_dynamic remains rejected except allowlist golang.org/x/sys and golang.org/x/sys/* (zsyscall trampolines)
4. //go:generate in GoFiles is inert — managers MUST NOT run generators; presence in vendored GoFiles does not fail preflight (go build -mod=vendor never executes it)

Refs: curator-spec:dce6643, curator:124654a / v0.14.0-rc.3, cocoaskills:main src/csk/builds/go_v1.py:784/852/1011. Verify with csk skill check and cached curator install.

Security: exceptions do not add execution during install; artifact never executed, curator-build-source-v1 binds every vendored file.

[ivanopcode]

Ported on branch task/TASK-260807-zna3vh-vendored-exceptions @ 70e9ca226c968f98b175a49e23a8e7766b290d5d (base origin/main b9ec253, no PR opened yet).

All four exceptions land as narrow allowlists in src/csk/builds/go_v1.py, matching curator 124654a:

1. Standard && Goroot result with empty Root + vendor/ import prefix stays trusted; the directory check still pins it below the fingerprinted GOROOT.
2. SFiles accepted only when the package dir is strictly below <build_root>/vendor and every entry is a regular file below the build root (so curator-build-source-v1 hashes it). SysoFiles and every cgo/C/C++/ObjC/Fortran/SWIG field are still rejected earlier in the same function.
3. //go:cgo_import_dynamic allowed only for golang.org/x/sys and golang.org/x/sys/*; the exact-/ boundary blocks the golang.org/x/sysfake prefix trap.
4. //go:generate needle removed from the directive scan; the file is still read end to end so go_source_unreadable is unchanged.

Verification against skill-project-management @ b381684 (3 go-v1 build commands, 188–228 packages each):

command	patched	baseline b9ec253
task-board	accepted	go_assembly_forbidden (github.com/coder/websocket)
task-board-tui	accepted	go_generator_forbidden (github.com/clipperhouse/displaywidth)
tb-sessiond	accepted	go_assembly_forbidden (github.com/coder/websocket)

Cold csk install builds all three artifacts; the cached re-install reports up-to-date and csk status shows all three BUILD rows current. csk skill check is ok (it validates the manifest only and never reaches the driver).

Gates: 1346 passed, 243 skipped; mypy strict clean. 4 new acceptance tests + 10 narrowness cases; the four acceptance tests fail against the unpatched driver.

No execution added: the diff contains no subprocess/Popen/os.exec*/os.system/spawn/eval/exec call, and LIST_ARGUMENTS, BUILD_ARGUMENT_PREFIX, PROCESS_GRAPH and MANDATORY_CONTROLS (incl. no-artifact-execution) are byte-identical.

Two notes for review:

• //go:generate is inert unconditionally, not vendored-only — that is what curator 124654a does and what the normative sentence in manager.md:2.3 says. Restricting it to vendored packages would make csk reject main-module sources that curator accepts.
• curator's scanSourceDirectives returns on the first needle hit per window, so a file with //go:generate early and //go:cgo_import_dynamic later returns 2 and never reports the cgo directive. Dropping the needle here avoids that hole; worth fixing upstream too.

The GOROOT/src/vendor exception is covered by unit tests only — goenv Go 1.25.5 on this host reports all 15 vendor/golang.org/x/... packages with Root populated, so the empty-Root quirk does not reproduce locally.

Leaving this open until the branch merges.