ci: migrate to standard reusable workflows

- Rename ci.yaml -> go-ci.yaml
- Rename lint.yaml -> go-lint.yaml
- Rename sast_codeql.yaml -> go-sast-codeql.yaml
- Use plexusone/.github reusable workflows
- Add path filters for Go files
- Add explicit permissions

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: grokify

.github/workflows/ci.yaml

@@ -0,0 +1,25 @@
+name: Go CI
+permissions:
+  contents: read
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
+      - '.github/workflows/go-ci.yaml'
+  pull_request:
+    branches:
+      - main
+    paths:
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
+      - '.github/workflows/go-ci.yaml'
+  workflow_dispatch:
+
+jobs:
+  ci:
+    uses: plexusone/.github/.github/workflows/go-ci.yaml@main

.github/workflows/go-ci.yaml

@@ -0,0 +1,27 @@
+name: Go Lint
+permissions:
+  contents: read
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
+      - '.golangci.yml'
+      - '.github/workflows/go-lint.yaml'
+  pull_request:
+    branches:
+      - main
+    paths:
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
+      - '.golangci.yml'
+      - '.github/workflows/go-lint.yaml'
+  workflow_dispatch:
+
+jobs:
+  lint:
+    uses: plexusone/.github/.github/workflows/go-lint.yaml@main

.github/workflows/go-lint.yaml

@@ -0,0 +1,29 @@
+name: Go SAST (CodeQL)
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
+      - '.github/workflows/go-sast-codeql.yaml'
+  pull_request:
+    branches:
+      - main
+    paths:
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
+      - '.github/workflows/go-sast-codeql.yaml'
+  schedule:
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+
+jobs:
+  sast:
+    uses: plexusone/.github/.github/workflows/go-sast-codeql.yaml@main