ci: "✅ Validate Go Project" is gated on the govulncheck allowlist, so its skip reads as a skipped Go suite

> 🤖 Generated by the Agentic Engineer

## Evidence

The check `✅ Validate Go Project` is skipped on pull requests that add or change Go code. On #6506 — which adds `internal/ciharness/ci_workflow_test.go` — it reported `skipped` while the Go suite ran perfectly well elsewhere.

The name promises Go-project validation; the gate is a single unrelated file:

```yaml
ci-go:
name: ✅ Validate Go Project
if: >-
... || (github.event_name == 'pull_request'
&& ... && needs.changes.outputs.govuln-allowlist == 'true')
```

and that filter matches exactly one path:

```yaml
govuln-allowlist:
- '.govulncheck-allow.txt'
```

So on a pull request the job answers "did the govulncheck allowlist change?", not "is the Go project valid". The work its name describes is actually done by the org-wide required workflow, under the separate check names `🧪 Test`, `🧹 Lint - golangci-lint` and `Analyze (go)`.

## Affected audience and impact

Anyone — human or agent — judging whether a change was tested. This repository already has an open issue about exactly the failure mode this name imitates: #6373, *"CI reports main green while the Go test suite is skipped"*. A checkname that says Go validation was skipped, on a PR that changed Go, is indistinguishable at a glance from that real defect.

The cost is a false alarm in the direction that matters. It is equally capable of the opposite error: someone who learns "that check is always skipped, ignore it" will also ignore it on the default-branch push where it is **not** skipped and genuinely does gate.

## Expected behaviour

The check name states what the job actually gates, so its status can be read without opening `ci.yaml`.

## Acceptance criteria

- [ ] The job's `name:` reflects its real trigger (the govulncheck allowlist), not general Go validation.
- [ ] No remaining check name implies the Go suite ran or was skipped except the ones that actually run it.
- [ ] `wait-for-validate-go`, which polls for a check whose name has the prefix `✅ Validate Go Project`, is updated in the same change or shown to be unaffected.

## Size

Small — a rename plus its one known consumer. The care is in the consumer, not the rename.

Part of #6373

Start in ci.yaml by locating the `ci-go` job, its `name:` and the `govuln-allowlist` condition, then find the `wait-for-validate-go` consumer that polls the existing name prefix. Update the check name and its known consumer so the status describes the allowlist gate, and verify no remaining check name implies that the Go suite ran or was skipped unless it actually does.

Written by the indexing model from the issue text.