Add AGENTS.md guidance for Go version cross-file consistency checks #3542

What happened

PR #3538 bumped Go from 1.26.3 to 1.26.7 across multiple files. The initial commit set go.mod to 1.26.8 but did not update Dockerfile base images (still pinned to 1.26.3). The fullsend review agent approved this commit at 13:06 UTC. CodeRabbit caught the mismatch four minutes earlier at 13:02 UTC, noting that with GOTOOLCHAIN=local the mismatched versions could cause build failures. The author then force-pushed a fix aligning all files to 1.26.7.

What could go better

The review agent needs repo-specific context about the semantic relationship between Go version pinning files. Currently, it can detect protected-path violations (a structural rule) but cannot detect cross-file version inconsistencies (a semantic rule) because AGENTS.md does not document which files must stay in sync when Go versions change. This is a high-confidence finding — the gap is clearly demonstrated by the agent approving a state that CodeRabbit flagged as a build-breaking mismatch. Issue #3360 addresses the prevention side (Renovate atomic updates) but does not help with review-time detection for manual bumps or partial Renovate PRs.

Proposed change

Add a new section to AGENTS.md under the development environment or architecture documentation that lists the Go version pinning files and their consistency requirement. Specifically:

Files that must declare the same Go version:

1. go.mod (line 3: go X.Y.Z)
2. acceptance/go.mod
3. tools/go.mod
4. tools/kubectl/go.mod
5. .tool-versions (golang X.Y.Z)
6. Dockerfile (FROM golang:X.Y.Z@sha256:...)
7. Dockerfile.dist (FROM go-toolset:X.Y.Z@sha256:...)

Reviewer guidance: When any PR modifies a Go version in one of these files, verify all seven files declare the same version. Mismatches between go.mod and Dockerfile base images can cause build failures when GOTOOLCHAIN=local is set. Note that Dockerfile image tags also require updated @sha256: digests.

This complements issue #3360 (Renovate atomic updates) by providing review-time detection for cases where Renovate is not involved.

Validation criteria

On the next PR that bumps the Go version in any of the listed files, the fullsend review agent should flag any version mismatches across the seven pinning files. Validate by checking the next 3 Go version bump PRs (manual or Renovate) and confirming the review agent either (a) verifies consistency when all files match or (b) flags mismatches when they don't.

Generated by retro agent from #3538