chore(devcontainer): install the go toolchain (#13513)

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

.devcontainer/Dockerfile

@@ -135,6 +135,36 @@ RUN UV_PYTHON_BIN_DIR=/usr/local/bin uv python install 3.13 \
   && ln -s python3.13 /usr/local/bin/python \
   && python --version
 
+# Install the Go toolchain. `tools/ods` and `cli` both pin `go 1.26.4` in their go.mod,
+# and the golangci-lint pre-commit hook builds against the same version — keep this in
+# sync with them and with GO_VERSION in .github/workflows/pr-golang-tests.yml.
+#
+# Fetched from go.dev with a pinned per-arch checksum (same shape as the prek install
+# above) rather than copied out of the official golang image: base images here route
+# through the ECR pull-through cache, which only populates on tag-based pulls, so a
+# `golang:...@sha256:...` stage fails to resolve until something has already pulled that
+# exact digest by tag. The sha256 pin is what defeats a compromised mirror or MITM, so
+# nothing is given up by not going through a registry.
+#
+# Module and build caches are not baked in; they live in the dev user's home
+# (see .devcontainer/zshrc).
+ARG GO_VERSION=1.26.4
+RUN set -eux; \
+  case "$(dpkg --print-architecture)" in \
+    amd64) GO_ARCH=amd64; \
+           GO_SHA256=1153d3d50e0ac764b447adfe05c2bcf08e889d42a02e0fe0259bd47f6733ad7f ;; \
+    arm64) GO_ARCH=arm64; \
+           GO_SHA256=ef758ae7c6cf9267c9c0ef080b8965f453d89ab2d25d9eb22de4405925238768 ;; \
+    *) echo "unsupported arch for go: $(dpkg --print-architecture)" >&2; exit 1 ;; \
+  esac; \
+  curl -fsSL -o /tmp/go.tar.gz \
+    "https://go.dev/dl/go${GO_VERSION}.linux-${GO_ARCH}.tar.gz"; \
+  echo "${GO_SHA256}  /tmp/go.tar.gz" | sha256sum -c -; \
+  tar -C /usr/local -xzf /tmp/go.tar.gz; \
+  rm -f /tmp/go.tar.gz
+ENV PATH=/usr/local/go/bin:$PATH
+RUN go version
+
 # Create non-root dev user with passwordless sudo
 RUN useradd -m -s /bin/zsh dev && \
   echo "dev ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/dev && \

.devcontainer/zshrc

@@ -6,5 +6,11 @@ if [ -f /workspace/.venv/bin/activate ]; then
   . /workspace/.venv/bin/activate
 fi
 
+# Go: park the module cache under ~/.cache (a named volume, like GOCACHE's default
+# ~/.cache/go-build) so the dep trees in tools/ods and cli survive container recreation,
+# and put `go install` output on PATH.
+export GOMODCACHE="$HOME/.cache/go-mod"
+export PATH="$HOME/go/bin:$PATH"
+
 # Source host zshrc if bind-mounted
 [ -f ~/.zshrc.host ] && . ~/.zshrc.host