feat(core): bootstrap the FinalWeave Go project

[ryan-wong-coder]

Linked Issue

Fixes #3

Summary

• Initialize the single Go module at github.com/wowtrust/final-weave with the TrustDB-aligned Go 1.26.5 and Cobra baseline.
• Add a diagnostics-only finalweave-node version command, reusable build metadata, and fail-closed bare-node behavior without a placeholder runtime.
• Add immutable v1 quorum parameters for exact n=3f+1, including exhaustive, negative, zero-value, race, and fuzz coverage.
• Enforce package dependency boundaries, module integrity, unit/race tests, and Linux amd64/arm64 builds in CI.
• Document the implemented bootstrap separately from the target architecture and align Dependabot/PR governance.

Scope And Project Status

• This PR solves one issue or one clearly scoped maintenance task.
• This PR excludes unrelated formatting, experiments, generated files, local data, credentials, logs, captures, and build artifacts.
• User-facing material distinguishes implemented behavior, target design, and roadmap work.
• No FinalWeave performance result is claimed.

The repository gains a code bootstrap and diagnostic CLI only. It still has no runnable consensus node, SDK, API, storage, networking, execution engine, proof implementation, container image, or production release.

Protocol, Safety, And Compatibility

• This PR does not change quorum, Byzantine fault, proposer-slot, stable-prefix, or epoch-transition rules.
• BatchAC semantics are unchanged.
• Canonical ordering and execution semantics are unchanged.
• External finality and proof semantics are unchanged.
• This PR does not change canonical encoding, domain separation, signatures, IDs, state commitments, or wire schemas.
• Storage, WAL, recovery, networking, admission, and cross-ledger boundaries are unchanged.
• No production path introduces unbounded work.

The quorum utility only codifies the already accepted v1 formulas and bounds. It accepts int to prevent pre-validation narrowing, rejects every non-v1 count, and makes invalid zero-value access fail-stop instead of exposing q=0 or k=0. It does not validate certificates, validator identities, epochs, keys, fragments, or signatures.

Validation

• git diff --check origin/main...HEAD
• python3 scripts/check_docs.py
• go mod verify and go mod tidy -diff
• go vet ./...
• go test -count=1 -shuffle=on -mod=readonly ./...
• go test -race -count=1 -shuffle=on -mod=readonly ./...
• go test -run='^$' -fuzz=FuzzNewQuorumParameters -fuzztime=5s ./pkg/types — 1,492,510 executions
• Linux amd64 and arm64 architecture checks and cross-builds
• YAML parsing and independent Go/CI/governance reviews

Checks not run and residual risk:

• Integration, E2E, model, Byzantine, partition, crash-recovery, snapshot, chaos, and performance suites are not created because this PR deliberately implements none of those runtime capabilities.
• Stage 0 remains incomplete; strict local configuration, error codes, logging/metrics, virtual time, deterministic network simulation, SBOM, and protocol vectors remain separate work.

Risk And Rollback

• Primary risk is mistaking a successful bootstrap command for a working validator. Bare finalweave-node exits nonzero, no run/start/serve command exists, and documentation states the boundary explicitly.
• Public quorum API misuse is bounded by an int constructor, exact v1 validation, unexported fields, and fail-stop invalid accessors.
• Architecture checks run for Linux amd64 and arm64, and a stable aggregate Go CI context will be added to branch protection after it first appears.
• Roll back by reverting this PR; it introduces no storage schema, protocol format, migration, external service, or persisted user data.