CI hardening (lint, vuln scan) + minimal container image

## Summary
Ensure baseline code quality and supply-chain hygiene with CI gates and a hardened container image.

## Motivation
- Catch bugs early
- Reduce image size and attack surface

## Scope
- GitHub Actions: build, test (`-race`, `-cover`), `golangci-lint`, `staticcheck`, `govulncheck`
- Minimal image (distroless or scratch), non-root, pinned versions
- Publish to GHCR on tags

## Acceptance Criteria
- CI fails on lint/vuln issues
- Image runs as non-root and starts with health/readiness endpoints

## Tasks
- [ ] Add workflows for build/test/lint/vuln
- [ ] Harden Dockerfile
- [ ] Tag build & push to GHCR