feat(sdk): bootstrap plugin SDK core and repository hygiene

[mwaldheim]

Summary

This PR bootstraps the first usable SDK baseline for out-of-process semrel plugins and aligns repository hygiene with the main project standards.

What’s included

1. Added a minimal SDK core for plugin authors:

• Shared go-plugin handshake configuration (protocol + magic cookie)
• Logger helpers with stderr-first defaults (stdout remains handshake-only)
• Local plugin discovery path builder matching ADR-001 layout
• Stable plugin type constants for the supported categories

2. Added initial SDK tests:

• Handshake config contract checks
• Discovery path shape checks
• Plugin type constant stability checks

3. Fixed module baseline:

• Removed broken dependency reference to a non-resolvable module
• Added required go-plugin and logging dependencies
• Regenerated module lock data via tidy

4. Added repository hygiene baseline:

• CI workflow (build + test + lint)
• DCO workflow
• REUSE compliance workflow
• OpenSSF Scorecard workflow
• Renovate workflow + Renovate config
• Standard .gitignore for Go SDK repository needs

Validation

1. go test ./... passes

Notes

1. CI in this repository currently uses direct Go commands instead of Make targets to keep the setup minimal and immediately runnable.
2. This PR is intentionally scoped as SDK/repo bootstrap so host-side ADR-001 transport integration can follow cleanly in the semrel repository.

[mwaldheim]

Closing: commits lack DCO sign-off, Go version references 1.24 (we're on 1.25+), and the registry rename is already done on main. Will re-open with fresh commits if the SDK bootstrap work is needed.