🌱 Standardize governance workflows, pre-commit, and remove legacy CI

Consolidated PR replacing llm-d#616 and llm-d#617.

Governance & tooling standardization:
- Simplify all governance workflows to use reusable patterns
- Add .pre-commit-config.yaml with standard hooks
- Update Dockerfiles and Makefile.tools.mk
- Update go.mod/go.sum dependencies
- Standardize test imports

Legacy CI cleanup:
- Remove check-typos.yaml and md-link-check.yml (replaced by pre-commit)
- Remove orphaned .lychee.toml and .typos.toml configs

Agentic workflows:
- Add typo-checker, link-checker, and upstream-monitor agentic workflows
- Add copilot-setup-steps and actions-lock config
- Add upstream-versions tracking doc

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Signed-off-by: Andrew Anderson <andy@clubanderson.com>

Author: clubanderson

.gitattributes

@@ -0,0 +1,2 @@
+.github/workflows/*.lock.yml linguist-generated=true merge=ours
+.github/workflows/*.campaign.g.md linguist-generated=true merge=ours

.github/aw/actions-lock.json

@@ -0,0 +1,14 @@
+{
+  "entries": {
+    "actions/github-script@v8": {
+      "repo": "actions/github-script",
+      "version": "v8",
+      "sha": "ed597411d8f924073f98dfc5c65a23a2325f34cd"
+    },
+    "github/gh-aw/actions/setup@v0.45.0": {
+      "repo": "github/gh-aw/actions/setup",
+      "version": "v0.45.0",
+      "sha": "58d1d157fbac0f1204798500faefc4f7461ebe28"
+    }
+  }
+}

.github/workflows/check-typos.yaml

@@ -40,8 +40,13 @@ jobs:
       - name: Checkout source
         uses: actions/checkout@v6
 
-      - name: Sanity check repo contents
-        run: ls -la
+      - name: Set up Python (for pre-commit and CGO)
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Run pre-commit checks
+        uses: pre-commit/action@v3.0.1
 
       - name: Extract Go version from go.mod
         run: sed -En 's/^go (.*)$/GO_VERSION=\1/p' go.mod >> $GITHUB_ENV
@@ -71,7 +76,7 @@ jobs:
       - name: Run lint checks
         uses: golangci/golangci-lint-action@v9
         with:
-          version: "v2.8.0"
+          version: "v2.1.6"
           args: "--config=./.golangci.yml"
           skip-cache: true
         env:

.github/workflows/ci-pr-checks.yaml

@@ -1,20 +1,9 @@
-name: Check Signed Commits in PR
-
-on:
-  pull_request_target:
+name: Check Signed Commits
+on: pull_request_target
 
 jobs:
-  check-signed-commits:
-    name: Check signed commits in PR
-    runs-on: ubuntu-latest
+  signed-commits:
+    uses: llm-d/llm-d-infra/.github/workflows/reusable-signed-commits.yml@main
     permissions:
       contents: read
-      pull-requests: write # Required to post comments on PRs
-    steps:
-      - name: Check signed commits in PR
-        uses: 1Password/check-signed-commits-action@v1 # Use the action
-        with:
-          comment: |
-            🚨 Unsigned commits detected! Please sign your commits.
-
-            For instructions on how to set up GPG/SSH signing and verify your commits, please see [GitHub Documentation](https://docs.github.com/en/authentication/managing-commit-signature-verification).
+      pull-requests: write

.github/workflows/ci-signed-commits.yaml

@@ -0,0 +1,20 @@
+name: "Copilot Setup Steps"
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+
+jobs:
+  copilot-setup-steps:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Install gh-aw extension
+        run: |
+          curl -fsSL https://raw.githubusercontent.com/githubnext/gh-aw/refs/heads/main/install-gh-aw.sh | bash
+
+      - name: Verify gh-aw installation
+        run: gh aw version