bug(setup-env): skill assumes Rust toolchain — should detect language and adapt (Go template included)

## Summary

`/vsdd-factory:setup-env` hardcodes a Rust toolchain as **required**:
`rustc`, `cargo`, `rustfmt (nightly)`, `clippy`, and the corresponding cargo-* tools for fuzz / mutation / formal verification / dep auditing.

On any non-Rust project, the skill reports a flood of MISSING for tools the project will never use. The universal tools (`git`, `gh`, `just`, `jq`) ARE language-agnostic and should stay; everything Rust-specific should be conditional on the detected language.

## Repro

Run `/vsdd-factory:setup-env` on any Go, Python, Node, or other-language project. The skill reports `rustc ❌`, `cargo ❌`, `clippy ❌`, `cargo-kani ❌`, etc. as missing required tools, even though the project's actual language toolchain is fully installed and verified.

## Proposed fix — language detection + polyglot tool map

### 1. Language detection (from manifest files)

```bash
detect_lang() {
test -f Cargo.toml && echo rust && return
test -f go.mod && echo go && return
test -f pyproject.toml && echo python && return
test -f setup.py && echo python && return
test -f package.json && echo node && return
echo unknown
}
```

### 2. Required toolchain per language

| Language | Required tools |
|----------|---------------|
| rust | rustc, cargo, rustfmt (nightly), clippy |
| **go** | **go (≥ go.mod's declared version), gofumpt, golangci-lint** |
| python | python (≥3.10), uv/uvx, ruff, mypy |
| node | node (≥ engines.node from package.json), pnpm or npm, tsc (if tsconfig), eslint |

Universal (regardless of language): git, gh, just, jq, lefthook (if `lefthook.yml` present)

### 3. Optional / phase-specific tooling

Mapping the optional Rust tools to their language equivalents (or noting "no equivalent" honestly):

| Purpose | Rust | **Go** | Python | Node |
|---------|------|--------|--------|------|
| Fuzz | cargo-fuzz | **`go test -fuzz`** (native, since 1.18) | atheris / hypothesis | jsfuzz |
| Mutation | cargo-mutants | **gremlins** | mutmut | stryker |
| Formal verification | cargo-kani | **no direct equivalent** — closest is `nilaway` (Uber, nil safety) + `staticcheck` + property tests via `rapid`/`gopter` | (no equivalent) | (no equivalent) |
| CVE / dep audit | cargo-deny | **govulncheck** + osv-scanner | pip-audit | npm audit |
| Static analysis | clippy (incl.) | **staticcheck**, **gosec**, **errcheck** (or just rely on golangci-lint to subsume these) | ruff, mypy, bandit | eslint, tsc |
| Benchmarking | cargo bench + critcmp | **`go test -bench` + benchstat** | pytest-benchmark | (varies) |
| Security scan | semgrep (universal) | semgrep (universal) | semgrep (universal) | semgrep (universal) |

### 4. Concrete Go template (drop-in for SKILL.md)

#### Required Go toolchain

| Tool | Check | Install |
|------|-------|---------|
| `go` | `go version` (≥ `go.mod`'s declared `go` directive) | brew install go (or asdf/mise/gvm) |
| `gofumpt` | `gofumpt -version` | `go install mvdan.cc/gofumpt@latest` |
| `golangci-lint` | `golangci-lint --version` | `brew install golangci-lint` (homebrew) or `curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh \| sh` |

#### Built-in Go capabilities (no install required — note these explicitly)

- `go test -fuzz` — native fuzzing since 1.18
- `go test -race` — race detector
- `go tool cover` — coverage
- `go mod verify` — module integrity
- `go vet` — built-in static analysis

#### Optional Go tooling (install when phase needs them)

| Tool | Purpose | Check | Install |
|------|---------|-------|---------|
| `staticcheck` | Static analysis (subset of golangci-lint usually) | `staticcheck --version` | `go install honnef.co/go/tools/cmd/staticcheck@latest` |
| `govulncheck` | CVE / advisory scan | `govulncheck -version` | `go install golang.org/x/vuln/cmd/govulncheck@latest` |
| `osv-scanner` | OSV vuln scanner | `osv-scanner --version` | `brew install osv-scanner` |
| `nilaway` | Uber nil-safety analyzer | `nilaway -V` | `go install go.uber.org/nilaway/cmd/nilaway@latest` |
| `gremlins` | Mutation testing | `gremlins --version` | `go install github.com/go-gremlins/gremlins/cmd/gremlins@latest` |
| `benchstat` | Benchmark comparison | `benchstat -h` | `go install golang.org/x/perf/cmd/benchstat@latest` |
| `goreleaser` | Cross-platform release builds | `goreleaser --version` | `brew install goreleaser` |
| `air` | Dev hot-reload | `air -v` | `go install github.com/cosmtrek/air@latest` |
| `gosec` | Security analyzer | `gosec --version` | `go install github.com/securego/gosec/v2/cmd/gosec@latest` |

#### Phase-mapping note (for Go projects)

- **Phase 3 (TDD)**: `go test`, `go test -race`, `go tool cover`, golangci-lint
- **Phase 5 (formal hardening)**: `go test -fuzz`, gremlins (mutation), nilaway + staticcheck (analysis), govulncheck + osv-scanner (security), semgrep
- The current Rust-centric description of Phase 5 (Kani proofs, cargo-fuzz, cargo-mutants, semgrep) needs a Go-equivalent paragraph because there is **no Go equivalent for Kani**. Document this gap honestly — formal verification of Go programs is materially weaker than Rust, and the pipeline should acknowledge that.

### 5. Output should mark non-applicable tools as N/A, not MISSING

On a Go project, rustc/cargo/clippy should appear as `N/A (Go project)` or be omitted entirely, not flagged as missing-required.

## Acceptance criteria

- [ ] `/vsdd-factory:setup-env` detects project language from manifest files (`Cargo.toml`, `go.mod`, `pyproject.toml`, `package.json`).
- [ ] On a Go project, the required block lists `go`/`gofumpt`/`golangci-lint` and verifies `go` ≥ the version declared in `go.mod`.
- [ ] On a Go project, the optional block lists `staticcheck`/`govulncheck`/`osv-scanner`/`nilaway`/`gremlins`/`benchstat`/`gosec`/`goreleaser`/`air`.
- [ ] On a Go project, the skill notes that fuzz / race / coverage / module verify are built into `go test`/`go tool` (no install needed).
- [ ] On a Go project, the formal-verification line acknowledges no Kani equivalent and recommends nilaway + staticcheck + rapid/gopter as the closest substitute.
- [ ] Rust tools appear as `N/A` (or are omitted) on non-Rust projects.
- [ ] Universal tools (git, gh, just, jq, lefthook) checked regardless of language.
- [ ] Phase descriptions (3, 5, 6) updated to reference language-appropriate tooling, with honest gaps documented.

## Found during

`/vsdd-factory:setup-env` on `switchboard-blue` (Go 1.26.2, go.mod declares 1.25.4, 2026-06-23, vsdd-factory@1.0.0-rc.21). The skill reported rustc/cargo/rustfmt/clippy/cargo-* as MISSING required tools. I substituted the Go template above; verified outputs:

```
Required Go toolchain:
✅ go 1.26.2 darwin/arm64
✅ gofumpt (devel, go1.25.3)
✅ golangci-lint 2.11.4

go.mod declares go 1.25.4, installed go 1.26.2 (compatible)

Built-in Go capabilities:
✅ go test -fuzz, -race, tool cover, mod verify

Optional Go tooling (this project, today):
✅ govulncheck (already installed)
❌ staticcheck, nilaway, gosec, errcheck, gocyclo, gremlins, benchstat, goreleaser, air, osv-scanner
```

## Related

- (this session, filed) #203 onboarding ordering, #204 orphan-branch recipe, #205 nested worktree mount, #206 dispatcher race, #207-209 factory-obs UX