TCC-S06: Report when go.mod's Go lags the latest patch of its minor #176

Severity: Medium (a stale go line turns govulncheck red on stdlib CVEs; Dependabot's go-directive handling is unreliable, dependabot-core #7895) · Epic: TCC · Landing order: 10 of 21 · Blocked by: #171

Add a scheduled go-patch-lag.yaml (own workflow, so NIT-S02 opens its own issue) comparing go.mod's Go with the latest patch of its minor from the official release feed; red when behind. A feed failure is red, never silently green.

Spec: openspec/specs/p5-tcc-toolchain-consistency/spec.md — TCC-S06, REQs REQ-TCC-S06-01, REQ-TCC-S06-02; proposed in #166. Gate-wiring rule: openspec/specs/README.md (every new guard, every mode, runs on pull_request in verify).

Acceptance (one PR; TDD — failing test first):

• REQ-TCC-S06-01 — comparison table-tested: behind, equal, ahead, minor mismatch, feed failure = red — bash hack/ci/go_patch_lag_test.sh
• REQ-TCC-S06-02 (adversarial) — feed failure is red, never green — bash hack/ci/go_patch_lag_test.sh --self-test

Done when: every REQ's Verify passes on the PR (or is post-merge with its follow-up issue linked), task check is green, and the gate-wiring rule holds.

Source: spec/oss-quality-signals @ 94be853 (independent review + cold adversarial review, 2026-10-05).