fix(release): add readiness platform go profile

[VelariumAI]

Summary

Adds a readiness-platform Go execution profile for RR002/RR003/RR004 fixture scripts.

This fixes the Termux/Android readiness stall where over-isolated project-local Go module/cache behavior caused long stalls or process loss during Go compile/link.

What changed

• Added shared readiness Go platform helpers in:
  • scripts/release_readiness/lib/common.sh
• Updated RR scripts to use the shared helper:
  • scripts/release_readiness/rr002_cli_smoke.sh
  • scripts/release_readiness/rr003_var_spine_smoke.sh
  • scripts/release_readiness/rr004_policy_statelock_smoke.sh
• Updated smoke tests:
  • scripts/release_readiness/test_rr002_smoke.sh
  • scripts/release_readiness/test_rr003_smoke.sh
  • scripts/release_readiness/test_rr004_smoke.sh

Termux / Android behavior

On Termux/Android:

• Detects low-resource Termux/Android profile.
• Uses existing Go toolchain cache.
• Does not copy or seed module cache into .local/.
• Does not force cold project-local GOPATH / GOMODCACHE.
• Keeps:
  • GOPROXY=off
  • GOSUMDB=off
  • GOFLAGS=-mod=readonly
  • GOMAXPROCS=1
  • GOMEMLIMIT=1024MiB
  • go test -p=1

Operator visibility

RR scripts now print before heavy Go commands:

• platform profile
• Go platform
• cache mode
• safety flags
• actual Go command
• elapsed time

This prevents long silent compile/link windows.

Scope

This PR does not:

• continue RR-005 implementation
• include RR-005 WIP
• modify vector/RAG/memory behavior
• modify runtime behavior
• call providers
• call network endpoints
• execute app tools
• mutate tags
• run release workflows
• publish releases
• modify private scanner artifacts
• modify private contracts

RR-005 WIP remains stashed and recoverable.

Review status

Independent review verdict: APPROVE.

Review confirmed:

• local module-cache seeding/copying removed
• Termux profile uses existing Go toolchain cache
• Go resource limits are applied
• RR002/RR003/RR004 semantics are preserved
• RR003 previous blocker resolved
• no release safety violations
• no unsafe shell additions
• no public attribution
• manifest remains 914 / 914

Validation

• bash scripts/release_readiness/test_smoke.sh passed.
• bash scripts/release_readiness/test_rr002_smoke.sh passed.
• bash scripts/release_readiness/test_rr003_smoke.sh passed.
• bash scripts/release_readiness/test_rr004_smoke.sh passed.
• bash scripts/check_promotion_manifest.sh passed with 914 / 914.
• git diff --check passed.
• bash scripts/release_readiness/rr002_cli_smoke.sh completed with RR002_INCOMPLETE and no blockers.
• bash scripts/release_readiness/rr003_var_spine_smoke.sh completed with RR003_PASS.
• bash scripts/release_readiness/rr004_policy_statelock_smoke.sh completed with RR004_PASS.
• bash scripts/release_readiness/readiness.sh completed with NEEDS_RR_SUITE.
• go test -p=1 ./pkg/releasecheck -count=1 passed.

Known limitation

Private scanner preflight was inconclusive on this Termux environment due scanner stall / zero-byte logs. Changed files are shell-only and were manually reviewed for unsafe shell, release, network, provider, and attribution patterns. Scanner-platform hardening should be handled separately.