ci: enable Go contract test gate (#562 3/4)

[WilliamBerryiii]

Part 3 of 4 splitting #562 into reviewable PRs.

Parent: #562
Depends on: #568

Scope

Activate the new path-gated go-tests.yml required check and wire changesInGoContractTests through the matrix and PR-validation aggregate. The blueprint tests added in PR 1 are exercised in CI for the first time here.

Files

• .github/workflows/go-tests.yml — new reusable workflow gated on goContractTests paths; must comply with .github/instructions/workflow-permissions.instructions.md (deny-all top-level + per-job least privilege).
• .github/workflows/matrix-folder-check.yml — surface changesInGoContractTests from the detector.
• .github/workflows/pr-validation.yml — add go-tests to the aggregate needs: list.

Acceptance criteria

• go-tests.yml passes actionlint and matches the workflow-permissions baseline.
• changesInGoContractTests flows: detector → matrix-folder-check.yml output → pr-validation.yml aggregate.
• Gate is idle for PRs that do not touch watched paths.
• Blueprint contract tests added in PR 1 run green when their paths change.