feat!: prepare GoKart v0.12.0

[garyblankenship]

Summary

Prepare GoKart v0.12.0 as a breaking pre-1.0 release. The generator is isolated behind internal command and generator packages, plain scaffolds default to the flat layout, and --structured preserves explicit structured generation.

Public Go APIs and JSON schemas remain compatible.

Breaking change and migration

• gokart new <name> now creates the minimal flat layout by default.
• Use gokart new <name> --structured for the previous structured layout.
• Integration flags continue to select the structured layout unless flat mode is explicitly requested, in which case unsupported combinations fail with the documented structured error.

Public readiness

• Adds the --structured documentation contract and corrected golden regeneration guidance.
• Verifies every module and both examples independently with GOWORK=off and no replacement injection.
• Makes examples/http-service a normal standalone module.
• Clears root and command-module lint findings without blanket suppressions.
• Adds CI, contribution/security guidance, issue forms, and the pull-request template.
• Refreshes OpenAI to v3.42.0, Goose to v3.27.2, and chi to v5.3.1.
• Prepares synchronized annotated root and module tag recipes for v0.12.0.

Independent Tier 3 review

The findings-first review reports zero remaining confirmed code blockers. Three confirmed issues were fixed before this PR:

1. Crash-window journal recovery could lose rollback after a destination write but before the applied marker persisted.
2. Fresh flat and structured projects compiled but their documented run commands failed when no example command was generated.
3. The Cobra-to-Kong migration drifted root, version, and config CLI compatibility behavior beyond the declared scaffold-layout break.

The final review artifact grades the review A- because remote publication and proxy checks remain sequencing-dependent; its deterministic artifact-contract evaluation is 102/102.

Verification

• scripts/verify-workspace.sh all
• golangci-lint run ./... at the root and in cmd/gokart
• go test -race ./... in cmd/gokart
• go test -race -count=10 -shuffle=on ./internal/...
• standalone go mod tidy -diff, go mod verify, and readonly tests for all nine modules and both examples
• generated flat, structured, global, sqlite, postgres, AI, and Redis compile/runtime matrix
• CLI help, version, config, aliases, modes, structured errors, and manifest probes
• just leaks and working-tree Gitleaks
• govulncheck across all nine modules: zero reachable vulnerabilities
• documentation tests, relative links, external-link probes, and git diff --check
• CI-equivalent verification from a no-local clean clone of the committed candidate

Release sequencing

No v0.12.0 tags or GitHub Release are created by this PR. After approval and rebase merge, the complete gate suite will be repeated on the merge tip before the nine synchronized annotated tags and curated GitHub Release are published.

[garyblankenship]

Independent Tier 3 public-readiness review

Result: zero remaining confirmed code blockers.

Confirmed findings fixed before acceptance:

1. Crash-window rollback safety — pending journal entries now distinguish exact pre-write state, expected post-write state, and ambiguous external mutation. Create, overwrite, pre-write, post-write, and dependency-boundary recovery tests pass under the race detector.
2. Generated-project runtime contract — fresh no-example flat and structured projects now print usage and exit successfully when run using their generated README commands. The generated-project matrix executes and asserts both paths.
3. CLI compatibility drift — root/config help, --version, config show, config-directory failure handling, JSON fields, and structured exit behavior were compared with v0.11.0; legacy metadata semantics are preserved so the default scaffold layout remains the only declared break.

Cleared lanes include generator path and symlink safety, locking, rollback/recovery, public Go APIs, JSON schemas, concurrency, dependencies and sums, docs/examples, CI/release mechanics, leak scanning, and all nine module vulnerability scans.

Residual: web has one module-only golang.org/x/crypto/openpgp advisory (GO-2026-5932) with zero imported or reachable vulnerable symbols and no published fix version.

Verification evidence:

• CI / verify: passed in 3m23s
• Fresh clone of the pushed release/v0.12.0 branch at d4a349d: clean
• Remote-clone scripts/verify-workspace.sh all: passed
• Remote-clone command go test -race ./...: passed
• Remote-clone root and command-module golangci-lint: 0 issues
• Local 10x shuffled internal race suite: passed
• Tier 3 report quality: A-; deterministic artifact-contract grade: 102/102

The review remains capped below A until merge-tip verification, synchronized tags, proxy visibility, and clean public installation are completed during the guarded publish stage.