feat!: add standalone Go contract tracer - #1

Add the first standalone Contract Tracer library and CLI to main. Starting from symbols or source locations and an invariant hypothesis, it assembles a bounded investigation scope with source evidence, possible relationships, candidate alternatives, and unresolved boundaries.

The analyzer combines typed calls/references and bounded value flow with SQLite storage, configured event APIs and lifecycle relationships. Configuration is strict and reusable, including database namespaces. Event construction includes typed keyed and positional struct literals; compound, multi-result and range assignments preserve uncertainty, including parenthesized field targets. Explicit same-line initializers retain distinct source owners. Real literal strings remain separate from unresolved spans across events, SQL and lifecycle values. SQL inventory follows the selected module boundary, and roots retain host filesystem lookup semantics. Windows loader workspace aliases are aligned without changing the recorded build or workfile. Global addresses escaping through calls remain candidates; ordinary database query calls use modeled method identities and receiver/query positions, while prepared statements retain query origins through bound and promoted receivers; generic cancellation registrations retain all source-site candidates; uncalled private callbacks retain unresolved inputs alongside known targets. Map lookups preserve typed nil and unknown alternatives alongside historical known candidates through fields, arrays, address loads, local helpers and valid pointer conversions. Generic context constructors preserve parent alternatives for cancellation signals and scheduler relays. Mixed interface calls retain dependency alternatives alongside local candidates so unknown results, callback escapes and map mutation effects remain visible. Bound external methods retain callbacks carried by receiver storage, and WaitGroup interface calls preserve outside alternatives alongside known groups.

Saved JSON/gzip analysis binds source, selected assets, loaded dependency sources, module/workspace inputs and build selections. Fresh and saved analysis verify inputs again before publishing results. Selected Go source paths are compared with captured parser inputs under the saved tests, tags and loader environment; root-local embedded matches in selected target packages are compared with their captured inventory before final content hashes. Output validation prevents reports from overwriting saved/resumed analysis through file, directory, parent-traversal, dangling-link and hard-link aliases. Saved and resumed analysis also rejects publication paths that replace captured inputs or add source-fingerprinted files, including paired report outputs. Explicit configuration files are protected from both snapshot and report outputs, including report-only runs. Report-only outputs also protect existing analyzed sources, embedded assets and module-resolution inputs; a new source-shaped report remains permitted. These checks require a stable filesystem namespace and do not provide atomic filesystem snapshots or sandbox the Go toolchain.

Go 1.27.0 is the minimum. Snapshots from earlier development versions missing architecture feature/experiment settings or the loaded Go source inventory must be regenerated. Root lookup follows the host filesystem, including Windows junction and drive-path forms. On Windows, all report and snapshot destinations reject ambiguous filenames ending in dots or spaces or using stream colons; file identity is checked again after snapshot creation before reporting.

Contributor commit hooks validate formatting/configuration; raw push hooks validate every non-deletion ref against clean tested HEAD before test/vet/build checks. CI runs Go checks and hook helpers on Linux and Windows, plus repository-wide pre-commit validation. Validation includes public-API and actual CLI regressions that fail on prior revisions, saved-analysis round trips, controlled late-input mutations and real Git transport tests. Final publication requires fresh general/security review and all five checks in both push and PR CI on the published head.

Markdown renders report values as literal text with context-specific encoding and visible control characters; JSON retains the original data. Reports retain contract_complete: false. The supplied invariant is a hypothesis, not an automatically verified specification. Reflection, unsafe/cgo, omitted build configurations, unavailable dependency bodies and unmodeled callbacks remain limits. The public tree contains no development reports or project-specific profile.