Add goldengen: classify versions by firing-set and generate minimal goldens

[sourcehawk]

What changed

Adds a new test-only package pkg/testing/goldengen that sweeps a consumer-supplied version universe, classifies versions into behaviorally-distinct gating regimes by firing-set, generates the minimal goldens covering them, and asserts per-fixture mutation gating.

The package is opt-in: consumers that do not import it pay nothing, and no reconcile path references it.

Public API surface

• Unit interface (RegisteredMutations, FiringSet, RenderYAML) with Resource(res, scheme) and Component(comp, scheme) adapters that delegate rendering to golden.Serialize / golden.SerializeComponent.
• Config[T], Fixture[T], Expect types plus Config.Validate() (non-empty Versions, non-nil Build, non-empty Dir, unique non-empty fixture names, non-empty expectation names, every Expect.For a member of Versions).
• Regime + ClassifyRegimes(versions, firing): groups versions by order-independent firing-set signature; representative is the first version in supplied order within a group.
• CheckGating(fixture, versions, firing): the Requires/Forbids lattice (existential vs. version-pinned).
• Manifest / FixtureManifest / RegimeManifest + Manifest.YAML().
• Generator[T], New(cfg), WithUpdate(bool), and Run(t): validates config, sweeps every fixture across every version, asserts gating, classifies into regimes, writes one golden per regime at <Dir>/<fixture>/<representative>.yaml and a coverage manifest at <Dir>/manifest.yaml. Honors WithUpdate.

AssertComplete and the YAML matrix loader are intentionally out of scope; they land in follow-up PRs.

How verified

• TDD throughout: each file's test written and watched fail before implementation.
• make all passes (lint, fmt, full test suite, examples build).

Towards #133