feat(go): complete Go kernel — full TS hook parity, 145x faster

[jpleva91]

Summary

• Complete Go kernel implementation replacing the TypeScript hook pipeline
• Go handles all hook events: PreToolUse, PostToolUse, Stop, Notification
• 145x faster hook evaluation: 2ms Go vs 290ms TS
• Root cause fix: FromStdin() fallback — Claude Code sends payloads via stdin, not env vars. The Go fast-path was never actually executing.

New Go files (975 lines added)

• env.go — .env loading (AGENTGUARD_* vars from project root)
• session.go — session state persistence (format/test pass, written files, retry counts) + root session tracking
• identity.go — agent identity resolution + wizard prompt
• lesson.go — denial lesson capture for educate mode learning
• telemetry.go — cloud telemetry client (async HTTP, 2s timeout)

Key changes

• types.go — FromStdin() reads JSON from stdin when env vars aren't set
• handler.go — monitor/guide/educate/enforce mode routing, read-only tool fail-open, invariant checking, retry tracking
• claude.go — full PreToolUse/PostToolUse/Stop/Notification event handling

Test plan

• All 14 Go packages pass (go test ./...)
• Write tool allowed through Go fast-path (exit 0)
• Force push denied by policy in enforce mode (exit 2)
• Force push warned in monitor mode (exit 0 + stderr warning)
• Guide mode retry tracking increments counter
• Verify CI passes (lint, test-and-build)

🤖 Generated with Claude Code